When I do "dig @a.gtld-servers.net xyz.com", it quickly returns the nameservers for xyz.com and the IP addresses for those nameservers (glue records).
Does that mean a.gtld-servers.net (and *.gtld-servers.net) have a record of all .com domains locally? They respond very quickly, so I don't think they're making a further query themselves. Similarly, a request for xyz.com's nameservers doesn't redirect me to "domains.starting.with.x.gtld-servers.net" or anything.
I do realize a.gtld-servers.net is probably several machines and that I'm being routed to the one nearest me (through that new one-ip-multiple-machine technology), but this would just mean several other machines have all .com domains.
EDIT: Thanks to everyone who answered! Followup question: if someone "hacks into" one of these machines, couldn't they get a list of all .com domains? This seems like useful information, unless it's already available somewhere for free? I realize domain information is public, but is still difficult to obtain in bulk. I'm guess *.gtld-servers.net don't support zone transfers (though .edu's nameservers did, at least a few years ago).