Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am unclear on how the Windows DNS server is supposed to used additional records (or additional section).

From a packet sniff I am noticing the following:

query root server for domain.com
response: gltd ns servers for .com (with additional records)
query GLTD server for domain.com
response: ns1.server.net (and ns2) for domain.com (with additional records)
query root server for ns1.server.net
response: gltd ns servers for .net (with additional records)
....

What I am confused on is why is the windows DNS server not using the IP in the Additional Records for ns1.server.net - but it goes and queries root servers? (not caching is disabled)

share|improve this question

2 Answers 2

This happens for security reasons - to prevent DNS spoofing (cache poisoning).

Your DNS server knows that these GTLD servers are authoritative for .com because it just got the referral for this from the root. Therefore it accepts the two NS-records as their record names are under .com.

However it does not know if these GTLD servers are also authoritative for .net or not. Therefore it cannot trust the additional records with record names under .net (they could be cached poison), and it restarts at the root to be sure.

share|improve this answer
up vote 1 down vote accepted

I believe I found the setting that controls this feature: http://support.microsoft.com/kb/316786

"Secure Cache Against Pollution setting" is one of the settings enabled.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.