The conventional setup for DNS services has an instance of tinydns as a private root content DNS server.
The servers/@ file for dnscache simply lists 127.53.0.1 (or whatever on-machine/on-site IP address tinydns is listening on).
Unconventionally, but in the old style of Bernstein djbdns, one can have the servers/@ file list the IP addresses of the public root content DNS servers run by ICANN.
The list of "." content DNS servers changes over time.
Some changes over the years to the list of ICANN's "." content DNS servers were on 2017-10-24, 2016-03-23, 2015-12-01, 2007-11-01, 2004-01-29, 2002-11-05, and 1997-08-22; and this is not even a complete list. The IP addresses do not change egregiously often in practice, and it is normally sufficient to update the list once or twice per year.
Bernstein djbdns shipped with a file named /etc/dnsroots.global which contained ICANN's list of these IP addresses as it stood in 2001.
It is no longer packaged by djbwares, in favour of just collecting the updated address list using this method instead.
It is nonetheless possible to limp along with this same list if one has it, a quarter of a century later, with somewhat degraded query resolution, and with the caveat that someone might re-use one of the old IP addresses and put a DNS server on it.
Use a command pipeline to obtain the list of IP addresses of the "." content DNS servers, directing its output to the root/servers/@ file, then restart the dnscache service:
~ #cd "$(system-control find dnscache@127.0.0.1)/service" /var/local/service-bundles/services/dnscache@127.0.0.1/service #cd "$(system-control print-service-env dnscache@127.0.0.1 ROOT" /var/local/service-bundles/services/dnscache@127.0.0.1/service/root #printf '%s\n' $(dnsip $(dnsns .)) > servers/.@.tmp /var/local/service-bundles/services/dnscache@127.0.0.1/service/root #mv servers/.@.tmp servers/@ /var/local/service-bundles/services/dnscache@127.0.0.1/service/root #system-control try-restart dnscache@127.0.0.1 /var/local/service-bundles/services/dnscache@127.0.0.1/service/root #
dnsip is IPv6-capable, and will print multiple IP addresses on a single line.
The ICANN "." content DNS servers all nowadays have both IPv4 and IPv6 addresses, a process that began in 2008.
The use of printf '%s\n' is a standard Unix idiom for separating these addresses onto individual single lines.
The use of .@.tmp is not necessary for dnscache, which does not re-read the servers/@ file once it has started. It is to avoid losing the original servers/@ file should a network outage or something cause the two lookup tools to fail. It is a wise idea to just look at the new file, and check that it really does list 26-or-so IP addresses, before moving it into place.