[H-SASIG] Move of Excalibur

James Iseppi james at iseppi.org
Fri Jan 1 10:15:28 EST 2010


Hi Russell,

On 01/01/2010, at 6:57 PM, Russell Stuart wrote:

> On Fri, 2010-01-01 at 03:02 -0500, Robert Brockway wrote:
>> The glue record is really just an A record in the parent zone file,  
>> so the
>> TTL of the parent zone applies.
>
> There is no doubt clients who read the glue record get the glue  
> record's
> TTL.  But the question is when if ever, is the glue record itself
> updated in the parent zone.  My guess is the glue record is treated as
> authoritative, and thus never times out.

If you query the name server for the parent zone, the TTL of the glue  
record will always be the same [1]. The glue records should only ever  
be delivered as part of the additional section, not as part of the  
answer section within the response. Therefore, no client [2] will ever  
receive the glue records as an answer to a query as the data in the  
additional section of a response is not considered authoritative [3].

> Think of it this way.  Lets say all DNS servers for xyz.com are hosted
> on xyz.com servers.  Eg, they are ns1.xyz.com, ns2.xyz.com, and
> ns3.xyz.com.  If the parent zone invalidated all of those zones  
> because
> of TTL expiry, how is it going to look them up again?  It can't.  Ergo
> they don't ever expire.

The caching I was referring to was within a caching name server only  
and this is only relevant to the caching server knowing the IP address  
to query for more information about that particular zone. It would  
never leave the internal caches of that server and would definitely  
never be sent as an answer to a client [2] computer. It does get used  
by the caching server to determine when they need to ask the parent  
zone's servers again for the domains delegation details.

> You might hope they would be a bit smarter about it.  For example, in
> our case assume the servers for humbug.org.au where just
> cartman.pipegrep.com.au and excalibur.humbug.org.au.  If you enter
> excalibur.humbug.org.au after entering cartman.pipegrep.com.au, you
> might hope they would ask cartman.pipegrep.com.au for excalibur's IP
> address.  They don't though.  As far as I can tell, the glue records  
> are
> only every updated manually.

Correct, the glue records can only ever be updated in the registry for  
the parent zone. However, there is a complicating factor to all this.  
The authoritative answer to any query comes from the name servers  
themselves, not the parent zone. This essentially means the glue  
records are not used except to initially query the servers responsible  
for a domain.

Below is an example of a DNS query for excalibur.humbug.org.au. The  
final answer that would be returned to a client is in the very last  
answer section received from cartman.pipegrep.com.au. Notice how  
although it was received from cartman, excalibur is listed as one of  
the authoritative servers. This means that excalibur may receive  
further queries from the server that performed this query, although it  
will never receive initial queries from a caching name server that has  
never asked about humbug.org.au before, or if the TTL expires for it's  
previously cached results. Additionally, the opposite is also true,  
cartman will receive initial queries about humbug.org.au but will  
never receive followup queries about the domain from the same caching  
name server as it is no longer listed in it's own response. It is  
likely that this will eventually cause a problem, particularly if the  
zoneedit.com servers were to fail and cartman were to become out of  
sync with excalibur (like it did during the migration). This would  
lead to a situation where the first query will return one answer from  
server A (which is listed at the registrar), but when that answer  
expires from the cache, a different answer will be returned by server  
B (which isn't listed at the registrar but is listed at server A).

$ dig excalibur.humbug.org.au A +trace +additional

; <<>> DiG 9.4.3-P3 <<>> excalibur.humbug.org.au A +trace +additional
;; global options:  printcmd
.			48474	IN	NS	b.root-servers.net.
.			48474	IN	NS	l.root-servers.net.
.			48474	IN	NS	h.root-servers.net.
.			48474	IN	NS	g.root-servers.net.
.			48474	IN	NS	i.root-servers.net.
.			48474	IN	NS	f.root-servers.net.
.			48474	IN	NS	a.root-servers.net.
.			48474	IN	NS	j.root-servers.net.
.			48474	IN	NS	m.root-servers.net.
.			48474	IN	NS	e.root-servers.net.
.			48474	IN	NS	k.root-servers.net.
.			48474	IN	NS	c.root-servers.net.
.			48474	IN	NS	d.root-servers.net.
d.root-servers.net.	604647	IN	A	128.8.10.90
e.root-servers.net.	604626	IN	A	192.203.230.10
f.root-servers.net.	604634	IN	A	192.5.5.241
g.root-servers.net.	602629	IN	A	192.112.36.4
h.root-servers.net.	604406	IN	A	128.63.2.53
i.root-servers.net.	604645	IN	A	192.36.148.17
j.root-servers.net.	48474	IN	A	192.58.128.30
j.root-servers.net.	48474	IN	AAAA	2001:503:c27::2:30
l.root-servers.net.	139787	IN	A	199.7.83.42
m.root-servers.net.	603156	IN	A	202.12.27.33
;; Received 400 bytes from 192.168.7.1#53(192.168.7.1) in 2 ms

au.			172800	IN	NS	a1.audns.net.au.
au.			172800	IN	NS	b1.audns.net.au.
au.			172800	IN	NS	ns1.audns.net.au.
au.			172800	IN	NS	ns2.audns.net.au.
au.			172800	IN	NS	udns1.ausregistry.net.au.
au.			172800	IN	NS	udns2.ausregistry.net.au.
au.			172800	IN	NS	udns3.ausregistry.net.au.
au.			172800	IN	NS	udns4.ausregistry.net.au.
au.			172800	IN	NS	udns5.ausregistry.net.au.
a1.audns.net.au.	172800	IN	A	202.12.29.59
b1.audns.net.au.	172800	IN	A	128.32.136.3
ns1.audns.net.au.	172800	IN	A	58.65.255.73
ns2.audns.net.au.	172800	IN	A	58.65.249.73
udns1.ausregistry.net.au. 172800 IN	A	156.154.100.18
udns2.ausregistry.net.au. 172800 IN	A	156.154.101.18
udns3.ausregistry.net.au. 172800 IN	A	156.154.102.18
udns4.ausregistry.net.au. 172800 IN	A	156.154.103.18
udns5.ausregistry.net.au. 172800 IN	A	156.154.104.18
a1.audns.net.au.	172800	IN	AAAA	2001:dc0:2001:a:4608::59
b1.audns.net.au.	172800	IN	AAAA	2607:f140:ffff:fffe::3
;; Received 435 bytes from 128.63.2.53#53(h.root-servers.net) in 276 ms

humbug.org.au.		14400	IN	NS	ns2.zoneedit.com.
humbug.org.au.		14400	IN	NS	ns16.zoneedit.com.
humbug.org.au.		14400	IN	NS	cartman.pipegrep.com.au.
;; Received 155 bytes from 58.65.249.73#53(ns2.audns.net.au) in 377 ms

excalibur.humbug.org.au. 600	IN	A	74.207.240.123
humbug.org.au.		600	IN	NS	ns16.zoneedit.com.
humbug.org.au.		600	IN	NS	excalibur.humbug.org.au.
humbug.org.au.		600	IN	NS	ns2.zoneedit.com.
;; Received 120 bytes from 66.135.54.100#53(cartman.pipegrep.com.au)  
in 254 ms

Therefore it is very important to ensure that all records at the  
registry accurately reflect the entries in the zone file. I've logged  
into the registrar and made the necessary changes [4] so that  
excalibur has the correct glue entries for it's new IP address, and  
these appear to have been correctly reflected in the whois database  
and DNS almost instantly. I've also added excalibur back in as a name  
server for the domain at the registrar. This means the only anomaly  
left is that cartman is not listed in the zone that it is responsible  
for according to the registrar. The two ways to solve this are to  
update the DNS zone (which I wasn't sure how to do on excalibur), or  
to remove cartman as being a name server from the registry and stop it  
slaving the zone from excalibur. I'm happy with either of these  
options, so if the the sysadmin's could make a decision and implement  
it that would be appreciated.

Below is the same query as above after the mentioned changes. Note  
that although the query was for the A record for  
excalibur.humbug.org.au it did not stop at ns2.audns.net.au even  
though it had received details for the A record. This is because those  
details of the A record were only sent as part of the additional  
section of the response and therefore could not be considered  
authoritative.

Thanks
James

[1] 14400 for .au zones
[2] I use the term client to refer to a resolver on a workstation that  
would usually expect all of it's answers from a local caching name  
server.
[3] The one exception to this would be if the same server has complete  
copies of both zones, and therefore can be considered authoritative  
for the final answer.
[4] If you'd like more details on what I changed and where, or the  
details to login to the registrar, let me know and i'll pass the  
information on.

$ dig excalibur.humbug.org.au A +trace +additional

; <<>> DiG 9.4.3-P3 <<>> excalibur.humbug.org.au A +trace +additional
;; global options:  printcmd
.			48474	IN	NS	b.root-servers.net.
.			48474	IN	NS	l.root-servers.net.
.			48474	IN	NS	h.root-servers.net.
.			48474	IN	NS	g.root-servers.net.
.			48474	IN	NS	i.root-servers.net.
.			48474	IN	NS	f.root-servers.net.
.			48474	IN	NS	a.root-servers.net.
.			48474	IN	NS	j.root-servers.net.
.			48474	IN	NS	m.root-servers.net.
.			48474	IN	NS	e.root-servers.net.
.			48474	IN	NS	k.root-servers.net.
.			48474	IN	NS	c.root-servers.net.
.			48474	IN	NS	d.root-servers.net.
d.root-servers.net.	604647	IN	A	128.8.10.90
e.root-servers.net.	604626	IN	A	192.203.230.10
f.root-servers.net.	604634	IN	A	192.5.5.241
g.root-servers.net.	602629	IN	A	192.112.36.4
h.root-servers.net.	604406	IN	A	128.63.2.53
i.root-servers.net.	604645	IN	A	192.36.148.17
j.root-servers.net.	48474	IN	A	192.58.128.30
j.root-servers.net.	48474	IN	AAAA	2001:503:c27::2:30
l.root-servers.net.	139787	IN	A	199.7.83.42
m.root-servers.net.	603156	IN	A	202.12.27.33
;; Received 400 bytes from 192.168.7.1#53(192.168.7.1) in 2 ms

au.			172800	IN	NS	a1.audns.net.au.
au.			172800	IN	NS	b1.audns.net.au.
au.			172800	IN	NS	ns1.audns.net.au.
au.			172800	IN	NS	ns2.audns.net.au.
au.			172800	IN	NS	udns1.ausregistry.net.au.
au.			172800	IN	NS	udns2.ausregistry.net.au.
au.			172800	IN	NS	udns3.ausregistry.net.au.
au.			172800	IN	NS	udns4.ausregistry.net.au.
au.			172800	IN	NS	udns5.ausregistry.net.au.
a1.audns.net.au.	172800	IN	A	202.12.29.59
b1.audns.net.au.	172800	IN	A	128.32.136.3
ns1.audns.net.au.	172800	IN	A	58.65.255.73
ns2.audns.net.au.	172800	IN	A	58.65.249.73
udns1.ausregistry.net.au. 172800 IN	A	156.154.100.18
udns2.ausregistry.net.au. 172800 IN	A	156.154.101.18
udns3.ausregistry.net.au. 172800 IN	A	156.154.102.18
udns4.ausregistry.net.au. 172800 IN	A	156.154.103.18
udns5.ausregistry.net.au. 172800 IN	A	156.154.104.18
a1.audns.net.au.	172800	IN	AAAA	2001:dc0:2001:a:4608::59
b1.audns.net.au.	172800	IN	AAAA	2607:f140:ffff:fffe::3
;; Received 435 bytes from 128.63.2.53#53(h.root-servers.net) in 276 ms

humbug.org.au.		14400	IN	NS	excalibur.humbug.org.au.
humbug.org.au.		14400	IN	NS	ns2.zoneedit.com.
humbug.org.au.		14400	IN	NS	ns16.zoneedit.com.
humbug.org.au.		14400	IN	NS	cartman.pipegrep.com.au.
excalibur.humbug.org.au. 14400	IN	A	74.207.240.123
;; Received 155 bytes from 58.65.249.73#53(ns2.audns.net.au) in 377 ms

excalibur.humbug.org.au. 600	IN	A	74.207.240.123
humbug.org.au.		600	IN	NS	ns16.zoneedit.com.
humbug.org.au.		600	IN	NS	excalibur.humbug.org.au.
humbug.org.au.		600	IN	NS	ns2.zoneedit.com.
;; Received 120 bytes from 74.207.240.123#53(excalibur.humbug.org.au)  
in 210 ms



More information about the Sasig mailing list