Subject: Re: SPF I-D for review: draft-schlitt-spf-classic-00.txt

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 12 Jan 2005 03:11:38 -0800 (PST)

On Wed, 12 Jan 2005, Stephane Bortzmeyer wrote:

> On Tue, Jan 11, 2005 at 02:02:10PM -0800,
>  william(at)elan.net <[email-masked]> wrote 
>  a message of 114 lines which said:
> 
> > They are not planning to "walk down the tree" but they will look
> > authoritive zone domain (the one that holds SOA for that domain)
> 
> The SPF draft says "the SPF client MUST find the Zone Cut as defined
> in [RFC2181] section 6" and RFC 2181 uses NS records, not SOA.
> 
> For a "normal" zone loaded by BIND, it does not matter. But you can
> always find funny cases where it's different depending on wether you
> use NS or SOA (study doesnotexist.ac).

The problems occur because one of their nameservers sometimes does not
work (ns2c.nic.ac which is referred to from some authority answers for ns)
but actual start of authority domain is the same no matter if you lookup
for SOA or NS. I preferred SOA because that is real authority data and 
this is what is (optional but almost always) included in authority section
when you lookup RR and it does not exist (NODATA) and frankly its an 
oversight on my part that I did not notice that reference is made to 
finding zonecut by means of NS.

This all points out that using existing DNS RFC2181 as reference for what 
we want is probably not the best idea and that we need new separate draft 
document explaining how these new zonecut default answer wildcards are 
supposed to work and how dns server can simulate and synthesize the answer
and how dns client (or dns resolver) can find it if the answer was not 
available by finding correct zonecut from either dns packet authority
section or making a separate lookup for that authority data.

Below are the results of me checking .ac as Stephane suggested - as you can
see they always provide same zonecut domain name answers. The difference 
does exist for sub.domain.com where some of the servers do provide the 
answer but majority do not. This should also be studied separately because
we need to decide how zonecut default wildcard should work for NXDOMAIN 
answers, but my own preference is that it SHOULD NOT apply there - if domain
is not available, then there would be no email coming from it (and if there
is it can be discarded by other means as Paul already indicated) and if 
somebody does care then they can just add regular "*" wildcard record.

--------------------------------------------------------------------------
Lookups for NS and SOA for NODOMAINHERE.AC (to compare AUTHORITY section) 
--------------------------------------------------------------------------
; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @a.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44170
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	593	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; Query time: 167 msec
;; SERVER: 64.251.31.177#53(a.nic.ac)
;; WHEN: Wed Jan 12 02:06:57 2005
;; MSG SIZE  rcvd: 84

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @a.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42572
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; ANSWER SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 182 msec
;; SERVER: 64.251.31.177#53(a.nic.ac)
;; WHEN: Wed Jan 12 02:07:05 2005
;; MSG SIZE  rcvd: 149

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @b.nic.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42829
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; Query time: 167 msec
;; SERVER: 66.235.201.216#53(b.nic.io)
;; WHEN: Wed Jan 12 02:07:15 2005
;; MSG SIZE  rcvd: 84

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @b.nic.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56857
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; ANSWER SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 134 msec
;; SERVER: 66.235.201.216#53(b.nic.io)
;; WHEN: Wed Jan 12 02:07:22 2005
;; MSG SIZE  rcvd: 149

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @b.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57591
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; Query time: 364 msec
;; SERVER: 217.160.203.158#53(b.nic.ac)
;; WHEN: Wed Jan 12 02:07:32 2005
;; MSG SIZE  rcvd: 84

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @b.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56061
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; ANSWER SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 304 msec
;; SERVER: 217.160.203.158#53(b.nic.ac)
;; WHEN: Wed Jan 12 02:07:45 2005
;; MSG SIZE  rcvd: 149

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @b.nic.sh
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37382
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; Query time: 166 msec
;; SERVER: 216.117.156.206#53(b.nic.sh)
;; WHEN: Wed Jan 12 02:07:59 2005
;; MSG SIZE  rcvd: 84

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @b.nic.sh
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63044
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; ANSWER SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 128 msec
;; SERVER: 216.117.156.206#53(b.nic.sh)
;; WHEN: Wed Jan 12 02:08:08 2005
;; MSG SIZE  rcvd: 149

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @ns2.jp.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55417
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 147 msec
;; SERVER: 202.181.97.168#53(ns2.jp.io)
;; WHEN: Wed Jan 12 02:08:30 2005
;; MSG SIZE  rcvd: 107

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @ns2.jp.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27911
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 130 msec
;; SERVER: 202.181.97.168#53(ns2.jp.io)
;; WHEN: Wed Jan 12 02:08:36 2005
;; MSG SIZE  rcvd: 107

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @ns3.icb.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3763
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; Query time: 292 msec
;; SERVER: 217.199.188.61#53(ns3.icb.co.uk)
;; WHEN: Wed Jan 12 02:08:52 2005
;; MSG SIZE  rcvd: 84

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @ns3.icb.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48018
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; ANSWER SECTION:
nodomainhere.ac.	600	IN	SOA	ns1c.nic.ac. admin.nic.ac. 2003120101 10800 3600 604800 3600

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 280 msec
;; SERVER: 217.199.188.61#53(ns3.icb.co.uk)
;; WHEN: Wed Jan 12 02:08:58 2005
;; MSG SIZE  rcvd: 149

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @ns2.uucp.ne.jp
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12657
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	NS

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 140 msec
;; SERVER: 202.181.96.60#53(ns2.uucp.ne.jp)
;; WHEN: Wed Jan 12 02:09:10 2005
;; MSG SIZE  rcvd: 107

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @ns2.uucp.ne.jp
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49812
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;nodomainhere.ac.		IN	SOA

;; AUTHORITY SECTION:
nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 125 msec
;; SERVER: 202.181.96.60#53(ns2.uucp.ne.jp)
;; WHEN: Wed Jan 12 02:09:14 2005
;; MSG SIZE  rcvd: 107

; <<>> DiG 9.2.1 <<>> ns nodomainhere.ac @ns1c.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8297
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.               IN      NS

;; AUTHORITY SECTION:
nodomainhere.ac.        600     IN      SOA     ns1c.nic.ac. admin.nic.ac. 
2003120101 10800 3600 604800 3600

;; Query time: 91 msec
;; SERVER: 216.117.170.115#53(ns1c.nic.ac)
;; WHEN: Wed Jan 12 02:59:55 2005
;; MSG SIZE  rcvd: 90

; <<>> DiG 9.2.1 <<>> soa nodomainhere.ac @ns1c.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31333
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;nodomainhere.ac.               IN      SOA

;; ANSWER SECTION:
nodomainhere.ac.        600     IN      SOA     ns1c.nic.ac. admin.nic.ac. 
2003120101 10800 3600 604800 3600

;; Query time: 166 msec
;; SERVER: 216.117.170.115#53(ns1c.nic.ac)
;; WHEN: Wed Jan 12 02:59:12 2005
;; MSG SIZE  rcvd: 90

--------------------------------------------------------------------------
Lookups for A for SUB.NODOMAINHERE.AC (to compare AUTHORITY sections) 
--------------------------------------------------------------------------

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @ns2.uucp.ne.jp
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62958
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; AUTHORITY SECTION:
sub.nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
sub.nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 140 msec
;; SERVER: 202.181.96.60#53(ns2.uucp.ne.jp)
;; WHEN: Wed Jan 12 02:09:22 2005
;; MSG SIZE  rcvd: 111

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @ns3.icb.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3351
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; Query time: 289 msec
;; SERVER: 217.199.188.61#53(ns3.icb.co.uk)
;; WHEN: Wed Jan 12 02:09:29 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @ns2.jp.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57455
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; AUTHORITY SECTION:
sub.nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.
sub.nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 203 msec
;; SERVER: 202.181.97.168#53(ns2.jp.io)
;; WHEN: Wed Jan 12 02:09:35 2005
;; MSG SIZE  rcvd: 111

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @b.nic.sh
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64983
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; Query time: 90 msec
;; SERVER: 216.117.156.206#53(b.nic.sh)
;; WHEN: Wed Jan 12 02:09:41 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @b.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 52524
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; Query time: 296 msec
;; SERVER: 217.160.203.158#53(b.nic.ac)
;; WHEN: Wed Jan 12 02:09:45 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @b.nic.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2781
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; Query time: 108 msec
;; SERVER: 66.235.201.216#53(b.nic.io)
;; WHEN: Wed Jan 12 02:09:49 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @a.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 483
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	A

;; Query time: 171 msec
;; SERVER: 64.251.31.177#53(a.nic.ac)
;; WHEN: Wed Jan 12 02:09:54 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> sub.nodomainhere.ac @ns1c.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58157
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.           IN      A

;; AUTHORITY SECTION:
nodomainhere.ac.        600     IN      SOA     ns1c.nic.ac. admin.nic.ac. 
2003120101 10800 3600 604800 3600

;; Query time: 207 msec
;; SERVER: 216.117.170.115#53(ns1c.nic.ac)
;; WHEN: Wed Jan 12 02:58:23 2005
;; MSG SIZE  rcvd: 94

--------------------------------------------------------------------------
Lookups for SOA for SUB.NODOMAINHERE.AC (to compare AUTHORITY sections) 
--------------------------------------------------------------------------

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @ns2.uucp.ne.jp
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18735
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; AUTHORITY SECTION:
sub.nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.
sub.nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 129 msec
;; SERVER: 202.181.96.60#53(ns2.uucp.ne.jp)
;; WHEN: Wed Jan 12 02:52:14 2005
;; MSG SIZE  rcvd: 111

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @ns2.jp.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9000
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; AUTHORITY SECTION:
sub.nodomainhere.ac.	86400	IN	NS	ns1c.nic.ac.
sub.nodomainhere.ac.	86400	IN	NS	ns2c.nic.ac.

;; ADDITIONAL SECTION:
ns1c.nic.ac.		3600	IN	A	216.117.170.115
ns2c.nic.ac.		3600	IN	A	64.251.31.233

;; Query time: 125 msec
;; SERVER: 202.181.97.168#53(ns2.jp.io)
;; WHEN: Wed Jan 12 02:52:17 2005
;; MSG SIZE  rcvd: 111

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @ns3.icb.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 42199
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; Query time: 258 msec
;; SERVER: 217.199.188.61#53(ns3.icb.co.uk)
;; WHEN: Wed Jan 12 02:52:52 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @b.nic.sh
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5653
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; Query time: 110 msec
;; SERVER: 216.117.156.206#53(b.nic.sh)
;; WHEN: Wed Jan 12 02:53:17 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @b.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9748
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; Query time: 280 msec
;; SERVER: 217.160.203.158#53(b.nic.ac)
;; WHEN: Wed Jan 12 02:53:27 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @b.nic.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 32734
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; Query time: 94 msec
;; SERVER: 66.235.201.216#53(b.nic.io)
;; WHEN: Wed Jan 12 02:53:34 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @a.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4826
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.		IN	SOA

;; Query time: 135 msec
;; SERVER: 64.251.31.177#53(a.nic.ac)
;; WHEN: Wed Jan 12 02:53:40 2005
;; MSG SIZE  rcvd: 37

; <<>> DiG 9.2.1 <<>> soa sub.nodomainhere.ac @ns1c.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 17808
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;sub.nodomainhere.ac.           IN      SOA

;; AUTHORITY SECTION:
nodomainhere.ac.        600     IN      SOA     ns1c.nic.ac. admin.nic.ac. 
2003120101 10800 3600 604800 3600

;; Query time: 135 msec
;; SERVER: 216.117.170.115#53(ns1c.nic.ac)
;; WHEN: Wed Jan 12 02:57:10 2005
;; MSG SIZE  rcvd: 94

--------------------------------------------------------------------------
Lookups for HINFO for NIC.AC (they have TXT record for NIC.AC but not HINFO)
--------------------------------------------------------------------------

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @ns2.uucp.ne.jp
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20391
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 116 msec
;; SERVER: 202.181.96.60#53(ns2.uucp.ne.jp)
;; WHEN: Wed Jan 12 02:45:59 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @ns3.icb.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24775
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 162 msec
;; SERVER: 217.199.188.61#53(ns3.icb.co.uk)
;; WHEN: Wed Jan 12 02:46:07 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @ns2.jp.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41250
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 137 msec
;; SERVER: 202.181.97.168#53(ns2.jp.io)
;; WHEN: Wed Jan 12 02:46:14 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @b.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48099
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 171 msec
;; SERVER: 217.160.203.158#53(b.nic.ac)
;; WHEN: Wed Jan 12 02:46:26 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @b.nic.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56580
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 21 msec
;; SERVER: 66.235.201.216#53(b.nic.io)
;; WHEN: Wed Jan 12 02:46:42 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @b.nic.sh
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11333
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 162 msec
;; SERVER: 216.117.156.206#53(b.nic.sh)
;; WHEN: Wed Jan 12 02:46:53 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> hinfo nic.ac @a.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34481
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nic.ac.				IN	HINFO

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 107 msec
;; SERVER: 64.251.31.177#53(a.nic.ac)
;; WHEN: Wed Jan 12 02:46:59 2005
;; MSG SIZE  rcvd: 72

--------------------------------------------------------------------------
Lookups for TXT for NS.NIC.AC (NS.NIC.AC host exist but does not have TXT)
--------------------------------------------------------------------------

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @ns2.uucp.ne.jp
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31761
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 125 msec
;; SERVER: 202.181.96.60#53(ns2.uucp.ne.jp)
;; WHEN: Wed Jan 12 03:10:23 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @ns3.icb.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26560
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 162 msec
;; SERVER: 217.199.188.61#53(ns3.icb.co.uk)
;; WHEN: Wed Jan 12 03:10:48 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @ns2.jp.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47938
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 125 msec
;; SERVER: 202.181.97.168#53(ns2.jp.io)
;; WHEN: Wed Jan 12 03:11:00 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @b.nic.sh
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61937
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 89 msec
;; SERVER: 216.117.156.206#53(b.nic.sh)
;; WHEN: Wed Jan 12 03:11:04 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @b.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38409
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 171 msec
;; SERVER: 217.160.203.158#53(b.nic.ac)
;; WHEN: Wed Jan 12 03:11:11 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @b.nic.io
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29993
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 21 msec
;; SERVER: 66.235.201.216#53(b.nic.io)
;; WHEN: Wed Jan 12 03:11:16 2005
;; MSG SIZE  rcvd: 72

; <<>> DiG 9.2.1 <<>> txt ns.nic.ac @a.nic.ac
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36464
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns.nic.ac.			IN	TXT

;; AUTHORITY SECTION:
nic.ac.			3600	IN	SOA	ns.nic.ac. nicadmin.nic.ac. 94 3600 1800 3600000 3600

;; Query time: 97 msec
;; SERVER: 64.251.31.177#53(a.nic.ac)
;; WHEN: Wed Jan 12 03:11:21 2005
;; MSG SIZE  rcvd: 72

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 12 Jan 2005 14:15:27 +0100

On Wed, Jan 12, 2005 at 03:11:38AM -0800,
 william(at)elan.net <[email-masked]> wrote 
 a message of 939 lines which said:

> but actual start of authority domain is the same no matter if you
> lookup for SOA or NS.

Not really, see later.

> I preferred SOA because that is real authority data 
...
> This all points out that using existing DNS RFC2181 as reference for
> what we want is probably not the best idea

I assume that RFC 2181 uses NS for a reason. I do not know it but we
could ask the authors or Google or the namedroppers' archive.

> and that we need new separate draft document explaining how these
> new zonecut default answer wildcards are supposed to work and how
> dns server can simulate and synthesize the answer and how dns client
> (or dns resolver) can find it if the answer was not available by
> finding correct zonecut

Good luck for the discussion on namedroppers :-)

> Below are the results of me checking .ac as Stephane suggested - as
> you can see they always provide same zonecut domain name
> answers. The difference does exist for sub.domain.com where some of
> the servers do provide the answer but majority do not.

This is because some name servers of the TLD are recursive but not all
(there is a "rd" in your flags but not always a "ra" in the
answer). Check with "dig +norecurse" and you'll see a different
picture, specially for zone cuts.