Subject: [dnsop] SOA in authority section for non-NXDOMAIN case?

From: bert hubert <[email-masked]>
Date: Thu, 28 Sep 2006 21:06:12 +0200

Check out this gem:

$ dig +norecurs bartmooreltci.com @69.88.130.100

; <<>> DiG 9.3.2 <<>> +norecurs bartmooreltci.com @69.88.130.100
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44249
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 3

(note that rd is set, even though we didn't ask for it!)

;; QUESTION SECTION:
;bartmooreltci.com.             IN      A

;; ANSWER SECTION:
bartmooreltci.com.      600     IN      A       64.7.202.222

;; AUTHORITY SECTION:
bartmooreltci.com.      200     IN      SOA     ns1.vitaldns.com. support.temp-url.com. 1001 28800 14400 604800 200
bartmooreltci.com.      86400   IN      NS      ns1.vitaldns.com.
bartmooreltci.com.      86400   IN      NS      ns2.vitaldns.com.
bartmooreltci.com.      86400   IN      NS      ns3.vitaldns.com.

;; ADDITIONAL SECTION:
ns1.vitaldns.com.       86400   IN      A       69.88.130.100
ns2.vitaldns.com.       86400   IN      A       64.7.223.100
ns3.vitaldns.com.       86400   IN      A       216.133.230.22

;; Query time: 199 msec
;; SERVER: 69.88.130.100#53(69.88.130.100)
;; WHEN: Thu Sep 28 21:02:49 2006
;; MSG SIZE  rcvd: 394

The PowerDNS Recursor chokes on this and I wonder if I should even fix it -
we can only resolve bartmooreltci.com once, it is extinguished by the SOA in
the authoritative section on the next query.

Oh well - we'll fix it anyhow, but still, this is very odd.

$ fpdns.pl 69.88.130.100
fingerprint (69.88.130.100, 69.88.130.100): q0r?1,QUERY,0,0,1,0,0,0,NOERROR,1,0,0,0

Yet another broken nameserver implementation.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: bert hubert <[email-masked]>
Date: Fri, 29 Sep 2006 01:32:38 +0200

On Fri, Sep 29, 2006 at 01:29:27AM +0200, Roy Arends wrote:
> Yeah, thats weird.

It has been reported that this appears to have been "fixed", I can't
reproduce it now. Perhaps the rd bit is random in their replies.

> May be odd, but perfectly legal:

Indeed - I've fixed the PowerDNS Recursor, but I'm pretty sure this
deviation from the norm if not the standard will cause problems in certain
places.

> Will add it to fpdns. I think this is ValidDNS.

Ironic :-)