Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hello I have just set up a DNS server for my domain example.org with 2 name servers ns1.example.org and ns2.example.org. I have attempted to set up a glue record for ns1 and ns2 at my registrar.

It seems to work for now when I do a dig example.org but when I do a whois example.org it lists ns1.example.org and ns2.example.org but not their IP address which should be set up as a glue record.

So I am wondering how do I check for the existence of a glue record? Do I do it with whois? I have seen .com and .net whois records that have both the domain name as well as the IP address for the name servers, is .org different? What's the proper way to test this?

Thanks.

share|improve this question

4 Answers 4

up vote 25 down vote accepted

Glue records only ever exist in the parent zone of a domain name.

Hence in the case of your example.org domain name, first find the .org name servers:

% dig +short org. NS
a0.org.afilias-nst.info.
a2.org.afilias-nst.info.
b0.org.afilias-nst.org.
b2.org.afilias-nst.org.
c0.org.afilias-nst.info.
d0.org.afilias-nst.org.

Then, for as many of these as you feel like testing, explicitly ask those name servers for the NS records for your domain:

% dig +norec @a0.org.afilias-nst.info. example.org. NS

You should get back the correct list of NS records in the "ANSWER SECTION". For any name servers that have correctly configured glue you should see those glue A (and/or AAAA) records appear in the "ADDITONAL SECTION".

share|improve this answer
    
Thanks a lot Alnitak that makes perfect sense! :) –  Sunnz May 17 '10 at 12:09

To check if a GLUE record is setup:

dig +trace @a.root-servers.net ns0.nameserverhere.com

If the GLUE is setup you should see a record that ends with:

“Recevied XXX bytes from x.GTLD-SERVERS.NET.”

There is also sites which will do it for you such as http://www.intodns.com/

share|improve this answer
    
Thanks, intodns worked great, getting all green ticks on the glue and NS stuff. I don't get the dig command though. I did get a Received message. In particular, I got this: "Received 433 bytes from 192.33.4.12#53(c.root-servers.net) in 183 ms." But then it ends with: "connection timed out; no servers could be reached" I also get similar messages when uses a random number for the ns part, e.g. ns384289.example.org. –  Sunnz May 16 '10 at 13:44
5  
that dig diagnostic test is completely wrong... –  Alnitak May 17 '10 at 10:25
    
I know this is old but very helpful. I piped the results into sed/awk to compare the root vs. nameserver to identify mismatched NS records. –  jeffatrackaid Jun 12 '13 at 13:55

Here is a little shell script which implements Alnitak's answer:

#!/bin/sh
S=${IFS}
IFS=.
for P in $1; do
  TLD=${P}
done
IFS=${S}

echo "TLD: ${TLD}"
DNSLIST=$(dig +short ${TLD}. NS)
for DNS in ${DNSLIST}; do
  echo "Checking ${DNS}"
  dig +norec +nocomments +noquestion +nostats +nocmd @${DNS} $1 NS
done

Pass the name of the domain as parameter:

./checkgluerecords.sh example.org
share|improve this answer

dig +trace is generally the most straightforward way to inspect the chain of delegations. However, glue records are in the additional section and by default trace output does not include the additional section. You will need to specify explicitly that you want this included in the output.

dig +trace +additional example.com


If the idea is to check the sanity of the delegation chain you will probably want to see the authoritative NS records as well, in this case:

dig +trace +additional example.com NS
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.