3 ms·
I thought NXDOMAIN responses indicated that the domain doesn't exist and there wasn't a way to actually direct the user anywhere. Your resolver could of course
by michaelmior 9y ago
I thought NXDOMAIN responses indicated that the domain doesn't exist and there wasn't a way to actually direct the user anywhere. Your resolver could of course lie and return an IP instead of NXDOMAIN however. Perhaps I'm wrong.
- duskwuff 9y agoThey take the "lie" route: # dig +short this-should-be-a-nxdomain.com @4.2.2.2 198.105.254.11 104.239.213.7 They do it a little more cleanly than some other attempts I've seen, but there's still flaws in their approach. In particular, they will generate redirects for NXDOMAIN responses to certain records under domains that do exist: # dig +short why-does-this-resolve.example.com @4.2.2.2 198.105.254.11 104.239.213.7 Specifically, they'll generate a redirect for any record that starts with the letter "w". (No, I'm not kidding. Try it.) Other records generate a real NXDOMAIN.
- michaelmior 9y agoRight, what I meant is that you can't return an NXDOMAIN response that "redirects" the domain. (Of course this isn't really a redirect per-se.)
- hoschicz 9y agoYou are correct, their resolver is basically lying.