4 ms·

This post is missing what is a very common DNS mis-configuration: extra, and/or lame delegations. The root will return the list of authoritative nameservers, b

This post is missing what is a very common DNS mis-configuration: extra, and/or lame delegations. The root will return the list of authoritative nameservers, but each of those authoritative servers may have a different list - and that list may still be used for resolution. For example, if the root says ns1,ns2.example.com are the nameservers for your domain, but ns1.example.com also lists ns3.example.com as an authoritative server, then resolvers WILL query ns3. If ns3.example.com does not actually have authority for your domain (I.e., a lame delegation), then DNS queries for your domain will fail some percentage of the time. It is valid (though confusing) to extend the list of authoritative nameservers from what the root says. But they had better all actually BE authoritative. In my experience, this is one of the more common DNS misconfigurations.

citrin_ru 5y ago
This misconfiguration is indeed very common and sometimes it is hard to explain why this is a problem - 'it works for me' it is a common reply I'm getting when reporting such problem. I wish domain registrars warned domain owners about lame delegations - they know owner's email or can show a message in an admin panel.
- jethro_tell 5y ago
  As a matter of practice, before removing an authoritative name server, we would usually point it to another server. I.e. ns3 might now point to ns2 and we'd Leve that for a few days as not all caching is respected. After that you can remove the server and the name and if it's cached somewhere, it still points to a valid server.
- bradknowles 5y ago
  Thirty years ago, there was a script for processing and notifying domain owners regarding those lame delegations. It was called lamers.sh, and I took over maintenance of it from Paul Mockapetris. But then we started getting so much pushback from people who were getting the notifications that the script was allowed to go unmaintained, and the situation has only gotten worse since.

citrin_ru 5y ago

This misconfiguration is indeed very common and sometimes it is hard to explain why this is a problem - 'it works for me' it is a common reply I'm getting when reporting such problem. I wish domain registrars warned domain owners about lame delegations - they know owner's email or can show a message in an admin panel.

jethro_tell 5y ago
As a matter of practice, before removing an authoritative name server, we would usually point it to another server. I.e. ns3 might now point to ns2 and we'd Leve that for a few days as not all caching is respected. After that you can remove the server and the name and if it's cached somewhere, it still points to a valid server.
bradknowles 5y ago
Thirty years ago, there was a script for processing and notifying domain owners regarding those lame delegations. It was called lamers.sh, and I took over maintenance of it from Paul Mockapetris. But then we started getting so much pushback from people who were getting the notifications that the script was allowed to go unmaintained, and the situation has only gotten worse since.