0

I'm hoping someone can give me a hand getting this configured. I am trying to get BIND to respond a certain way to reproduce a hosted DNS provider's behavior. I'm fairly new to DNS, but I'm hitting a roadblock that I just can't get past.

When I query my hosting provider's DNS servers, the NS record comes back as an Answer record.

# dnsq NS www.example.com ns.host.com
2 www.example.com:
113 bytes, 1+2+0+2 records, response, noerror
query: 2 www.example.com
answer: www.example.com 3600 NS lb1.example.com
answer: www.example.com 3600 NS lb2.example.com
additional: lb1.example.com 3600 A 1.2.3.4
additional: lb2.example.com 3600 A 5.6.7.8

When I query my internal BIND server, the NS record comes back as an Authority record.

# dnsq NS www.test.com bind.local
2 www.test.com:
110 bytes, 1+0+2+2 records, response, noerror
query: 2 www.test.com
authority: www.test.com 3600 NS lb1.test.com
authority: www.test.com 3600 NS lb2.test.com
additional: lb1.test.com 3600 A 10.254.0.1
additional: lb2.test.com 3600 A 10.254.0.2

The difference ends up changing client behavior in that Authority responses are then queried, but Answer responses are not. (ie. in the second case, ns1.test.com or ns2.test.com is queried to find the "actual" NS record.) This is behavior I would like to avoid. What settings would I change in BIND to have NS records returned as Answer responses?

Edit 1

As requested, here is the relevant sections of the zone file from the hosting provider:

$ORIGIN example.com.
@   86400   IN  SOA <omitted> <omitted> 104 28800 450 1209600 900
lb1 3600    IN  A   1.2.3.4
lb2 3600    IN  A   5.6.7.8
@   172800  IN  NS  ns1.host.com.
@   172800  IN  NS  ns2.host.com.
www 3600    IN  NS  lb1.example.com.
www 3600    IN  NS  lb2.example.com.
ns1 86400   IN  A   <Host's Nameserver>
ns2 86400   IN  A   <Host's Nameserver>

And from my BIND local server:

$TTL 1h
test.com.               IN  SOA ns1.test.com. ns2.test.com. (
    1   ;
    10000   ;
    3600    ;
    86400   ;
    3600    )   ;
; Name servers
test.com.               IN  NS  ns1.test.com.
test.com.               IN  NS  ns2.test.com.
;
; Addresses
ns1.test.com.           IN  A   10.254.0.1
ns2.test.com.           IN  A   10.254.0.2
lb1.test.com.           IN  A   10.254.0.101
lb2.test.com.           IN  A   10.254.0.102
;
; Delegation
www.test.com.           IN  NS  lb1.test.com.
www.test.com.           IN  NS  lb2.test.com.

What I am trying to do is delegate www.test.com to a pair of DNS load balancer.

Edit 2

As requested, here is the output of a dig against the hosted DNS provider with recursion off:

# dig +norecurse @ns.host.com www.example.com ns

; <<>> DiG 9.5.1-P2.1 <<>> +norecurse @ns.host.com www.example.com ns
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14494
;; flags: qr; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;www.example.com.   IN  NS

;; ANSWER SECTION:
www.example.com. 3600   IN  NS  lb2.test.com.
www.example.com. 3600   IN  NS  lb1.test.com.

;; ADDITIONAL SECTION:
lb2.test.com. 3600  IN  A   83.246.78.219
lb1.test.com. 3600  IN  A   96.56.160.204

;; Query time: 88 msec
;; SERVER: 216.239.128.4#53(216.239.128.4)
;; WHEN: Fri Aug 12 12:16:42 2011
;; MSG SIZE  rcvd: 113
2
  • Please provide your current zone configuration (scrubbing sensitive details as needed). Aug 10, 2011 at 19:29
  • Edited the original questions with zone configurations. Hope that helps. Aug 10, 2011 at 19:58

2 Answers 2

1

Strictly speaking, bind is correct. There may be additional NS records that the "true nameservers" know about and the client is right to query them to find out.

To duplicate the behaviour of your hosting provider's nameserver, you may have to use the same software. I don't believe you can do it with bind.

1
  • Thanks for the tip. The solution ended up being to modify the software at lb1 and lb2 to return NS records for both nameservers (as opposed to just one). This caused DNS caches to to cache both instead of just one. Sep 1, 2011 at 12:22
0

I suspect your hosting provider's nameserver either is responding recursively or is authoritative for the www.example.com zone. You may want to query with no recursion desired bit off to check.

dig +norecurse @ns.host.com www.example.com ns
3
  • What am I looking for in the output to see if it is authoritative? Aug 12, 2011 at 16:18
  • # dig +norecurse @ns.host.com www.example.com ns ; <<>> DiG 9.5.1-P2.1 <<>> +norecurse @ns.host.com www.example.com ns ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14494 ;; flags: qr; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.example.com. IN NS ;; ANSWER SECTION: www.example.com. 3600 IN NS lb2.test.com. www.example.com. 3600 IN NS lb1.test.com. ;; ADDITIONAL SECTION: lb2.test.com. 3600 IN A 83.246.78.219 lb1.test.com. 3600 IN A 96.56.160.204 Aug 12, 2011 at 16:19
  • Sorry for the mess above, I'll post it in the question. Aug 12, 2011 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .