5 ms·
> I had never heard of the ordering of the DNS servers being meaningful Now you have. This is a common configuration in mixed-use situations. > I'm amazed peo
by pdkl95 9y ago
> I had never heard of the ordering of the DNS servers being meaningful
Now you have. This is a common configuration in mixed-use situations.
> I'm amazed people are relying on that behaviour described in the ticket
Why? Using each server in order is the expected behavior. From resolv.conf(5)
nameserver Name server IP address
Internet address of a name server that the resolver
should query [...]. If there are multiple servers,
the resolver library queries them in the order listed.
[...] (The algorithm used is to try a name server, and
if the query times out, try the next, until out of
name servers, then repeat trying all the name servers
until a maximum number of retries are made.)
> Having a DNS setup that works in a different way when stuff fails should be seen as a bug;
You can call it a bug in your use cases, but having an imperfect fallback is important in some situations.
> DNS is supposed to be reliable.
Software is supposed to be lots of things, but good engineering understands that sometimes the real world deviates from these ideal.
- ealexhudson 9y agoY'see, I do get all that. And I could have phrased the "never heard of ordering" thing better: of course I have. What I've never heard of is people relying on that to get DNS results correct. If your first server doesn't work, you _get the wrong results_. I don't understand on what planet that is acceptable sysadmin setup. Split DNS zones have been a thing for years. This isn't a good substitute.
- ChuckMcM 9y agoI see it as implementation being perceived as architecture. The instance of the library that is quoted does this, it is not part of the architecture. That library has been used in a lot of places, so people start relying on the side effect (a common one is to stand up a local DNS server, have it 'shadow' or give alternative results to some queries, like ad network host names, and if the host name isn't in it then to fail so that the next DNS server is queried which is more likely a 'legit' server.) One of the reasons the IETF likes multiple running implementations of an RFC is they often have different side effects and so they call out things which might hang people up. The "correct" way to shadow, and to achieve user required semantics, is to create a DNS proxy that answers queries that it is supposed to and recursively getting results for ones that it doesn't. Correct here is in scare quotes because it doesn't mean it is right but instead just insures side effects of the libraries will not be a problem.
- deleted 9y ago[deleted]