This is an old style referral like you would have got out of BIND4 where the referral appears in the answer section. Note AA is NOT set so it is not a valid answer to the question.
% dig +norec ns ok.contact @fwd3.dccdns.com ; <<>> DiG 9.15.4 <<>> +norec ns ok.contact @fwd3.dccdns.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11820 ;; flags: qr ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ok.contact. IN NS ;; ANSWER SECTION: ok.contact. 3600 IN NS fwd1.dns.ws. ok.contact. 3600 IN NS fwd3.dns.ws. ok.contact. 3600 IN NS fwd2.dns.ws. ok.contact. 3600 IN NS fwd4.dns.ws. ;; Query time: 176 msec ;; SERVER: 64.70.78.82#53(64.70.78.82) ;; WHEN: Thu Jul 08 15:09:04 AEST 2021 ;; MSG SIZE rcvd: 121 % > On 8 Jul 2021, at 01:03, tale <d.lawre...@salesforce.com> wrote: > > On Mon, Jul 5, 2021 at 8:20 PM Mark Andrews <ma...@isc.org> wrote: >> This is an error with the delegation of ok.contact. The NS records at the >> delegation point do >> not match those at the zone apex. > > I'm curious if this is a re-purposing of the existing "non-improving > referral" message. I totally get how that brief phrase makes sense > for a sideways referral, but I'm not seeing how that statement makes > sense for ok.contact. > > # Delegation for .contact > $ dig +noall +auth ns contact @a.root-servers.net > contact. 172800 IN NS demand.beta.aridns.net.au. > contact. 172800 IN NS demand.alpha.aridns.net.au. > contact. 172800 IN NS demand.delta.aridns.net.au. > contact. 172800 IN NS demand.gamma.aridns.net.au. > > # Delegation for ok.contact > $ dig +noall +auth ns ok.contact @demand.alpha.aridns.net.au. > ok.contact. 86400 IN NS fwd2.dccdns.com. > ok.contact. 86400 IN NS fwd1.dccdns.com. > ok.contact. 86400 IN NS fwd4.dccdns.com. > ok.contact. 86400 IN NS fwd3.dccdns.com. > > # Apex NS for ok.contact > $ dig +noall +ans ns ok.contact @fwd1.dccdns.com > ok.contact. 3499 IN NS fwd4.dns.ws. > ok.contact. 3499 IN NS fwd2.dns.ws. > ok.contact. 3499 IN NS fwd1.dns.ws. > ok.contact. 3499 IN NS fwd3.dns.ws. > > Yes, the apex NS names aren't the same as the delegating NS (though > the adb addresses are), but that last one isn't a referral. > > I trust you are right, Mark. I'm just not sure what I'm missing about > "non-improving referral". > -- > tale -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
