Subject: heads up: some practical DNS real life things you might want to know

From: bert hubert <[email-masked]>
Date: Fri, 14 Apr 2006 09:42:27 +0200

Hi namedroppers,

Thanks for the verbose and useful answers to my recent question about
127.in-addr.arpa and other important zones. In the not too far future, the
PowerDNS recursor will get a small authoritative part to serve these zones,
out of the box.

Some things I want to share:

1) Mandatory compression
There are domestic routers out there that proxy DNS queries, so computers
behind it configure the router as their nameserver. In the course of
migrating a large access provider to the PowerDNS recursor, the helpdesk
received a slow trickle of calls from owners of certain brands of router who
lost the ability to resolve domains, and hence use the internet.

A long period of study later it was discovered a recent change in PowerDNS
disabled compression of the first DNS answer against the original question,
and that these routers consider 'c0 0c' to be a magic 'Start of Answer'
marker. And crash when they can't find it. More gory detail over at
http://blog.netherlabs.nl

So be aware, in the real world, compression is no longer optional but
mandatory.

2) question count = 0

There is a nameserver implementation out there that zeroes the original
question upon replying for domains it is not authoritative for:

$ dig ds9a.nl @xx.1x9.1.61

; <<>> DiG 9.3.1 <<>> ds9a.nl @xx.1x9.1.61
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 33769
;; flags: qr rd ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 35 msec
;; WHEN: Fri Apr 14 09:37:06 2006
;; MSG SIZE  rcvd: 12

$ dig +norecurs ds9a.nl @xx.1x9.1.61

; <<>> DiG 9.3.1 <<>> +norecurs ds9a.nl @xx.1x9.1.61
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 15698
;; flags: qr ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 35 msec
;; WHEN: Fri Apr 14 09:37:51 2006
;; MSG SIZE  rcvd: 12

fpdns.pl outputs:
q0r?1,IQUERY,0,0,1,1,0,0,REFUSED,0,0,0,0

This makes the PowerDNS spoofing detection act up, so I'm special casing the
question count = 0 case.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>