On Feb 6 2009, Mark Andrews wrote:
In message <prayer.1.3.1.0902051754210.4...@hermes-2.csi.cam.ac.uk>,
Chris Thompson writes:
[...]
More info about the "not consistently" bit. With nothing about
them in the cache ("rndc flushname advocaat.pro") looking up SOA or
NS records for them gives SERVFAIL. But looking up A records does
not, and after that SOA and NS lookups work OK as well.
Hmmm...
The TLD lies. DNSSEC is doing exactly what it is
supposed to do and is blocking ibad answers.
Mark
; <<>> DiG 9.3.6-P1 <<>> advocaat.pro soa @c.gtld.pro +dnssec
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29667
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;advocaat.pro. IN SOA
;; AUTHORITY SECTION:
pro. 14400 IN SOA a.gtld.pro.
hostmaster.registrypro.pro. 2009020518 28800 7200 604800 300
Ah, yes -- many thanks for the elucidation.
Indeed, looking up SOA for advocaat.pro via a non-validating nameserver
(without it having already discovered the NS records for it) believes
this crap and reports it back to the caller.
The nameservers for "pro" seem to have some very odd bugs:
* asked about the SOA for a sub-zone, they authoritatively deny its
existence, as above.
* asked about NS records for a sub-zone, they return the delegation
set as the _answer_. That's also true of the *.gtld-servers.net lot,
but these are worse, because unlike them they claim the answer is
authoritative.
* even when they do give a referral, it is marked authoritative.
One hardly dares to ask how they achieve all this ...
--
Chris Thompson
Email: c...@cam.ac.uk
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
