Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If you run a dig on someone using UltraDNS then you see that they use different domain names to run their DNS system - why?

$ dig ns emailsrvr.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> ns emailsrvr.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27922
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;emailsrvr.com.   IN NS

;; ANSWER SECTION:
emailsrvr.com.  86400 IN NS pdns4.ultradns.org.
emailsrvr.com.  86400 IN NS pdns3.ultradns.org.
emailsrvr.com.  86400 IN NS pdns2.ultradns.net.
emailsrvr.com.  86400 IN NS pdns1.ultradns.net.
emailsrvr.com.  86400 IN NS pdns6.ultradns.co.uk.
emailsrvr.com.  86400 IN NS pdns5.ultradns.info.
share|improve this question

3 Answers 3

up vote 0 down vote accepted

I'm a little surprised by your response. UltraDNS is following a very logical diversity scheme to provide superior redundancy for their clients. This far exceeds what most providers do. As far as the recursive server you are mixing different DNS rules together. A recursive server is seldom going to query the root for the authority TLD servers. Those answers are almost always cached. In addition the first query for a name server ends the set of requests at the SLD level unless the name server is offline and then it would need to do another request anyway. UltraDNS uses a global anycast network for their name servers so it would be almost impossible to have their name servers offline. UltraDNS is one of the largest providers in the world and handles most mission critical websites. I think you will find they understand DNS better than most people. Have you seen their new FREE tool site http://www.UltraTools.com ?

share|improve this answer

I would guess this is for robustness against a problem in the top-level domain under which their server sits, or (perhaps more likely) some local client having a problem resolving one of them.

share|improve this answer

It doesn't make sense to me. The recursive resolver needs to

  1. query the root namespace for ".com" just to get the NS for emailserver.com
  2. then it queries the "com root" for "emailserver.com"

Since the com root must be queried and responsive, I see no reason that the parent name server have a different TLD.

As a matter of fact, any name server that does not end with .com will result in one additional query, and is therefore not efficient.

I see no reason for the name server to be configured this way, and think this is an error.

UltraDNS does have servers located in different subnets as required by the RFC (2 are a minimum, 3 is recommended), so choosing a set of servers with different class C subnet is a valid need but I doubt if this is what is actually happening.

This should be fixed by including 3 name servers that end with .com and have different class C addresses.

share|improve this answer
    
ultradns presumably serve domains in other than just .com from these same nameservers. Anyhow, when do you think this additional query will happen? Won't all of the addresses be passed back in the Additional section when the query is first answered? –  poolie Nov 23 '10 at 21:13
    
I actually have a question about the security of a recursive resolver that uses or caches "Additional" records that aren't a direct "name-child-descendent" of the parent. To me this seems like a record that may poison a cache and should be discarded. If the discard happens then the address in the "Additional" section is ignored resulting in the second query to the root. I've posed this question to the new Security forum, but with no response yet: security.stackexchange.com/questions/713/… –  makerofthings7 Nov 23 '10 at 21:17
    
Interesting question, though only fairly incidental to this question, because the same problem can occur regardless of where the nameservers are located. See <en.wikipedia.org/wiki/DNS_cache_poisoning#Variants>; –  poolie Nov 24 '10 at 20:44
    
In your answer, I think step 2 should be that it asks one of the nameservers for emailsrvr.com for the A record for emailsrvr.com. Actually in this exact example, he's only asking for the NS record so no second query is needed. –  poolie Nov 24 '10 at 20:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.