Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

using the examples below

dig +trace dig +trace

dig +trace dig +trace

the first two show me only the A records for the queried domain, while the last two show me the A, or CNAME, as well as multiple NS records.

Can someone explain what config on the DNS server controls this behaviour, causing all of your nameservers being sent in response to this type of dig lookup. Also, is it possible to disable this behaviour so in the first two examples.. so that only the A record is sent and not the authoritative nameservers as well?

I would like to sync my domain with UltraDNS and configure the domain to use their nameservers to avoid DNS DDoS attacks on our DNS servers. But with the above behaviour, when people 'dig +trace' the domain it replies with our nameservers so making the exercise of trying to hide them pointless.

thanks fLo

share|improve this question
On my computer, all the queries you put as example have the same behavior: the one describe in the manpage. it prints all necesssary RR to trace the delegation path. This path include NS records in all cases. – Manu H Oct 8 '14 at 7:11

2 Answers 2

up vote 1 down vote accepted

The difference is that and are returning an AUTHORITY section, but and are not.

$ dig +noall +question +authority
;                     IN      A              172800  IN      NS              172800  IN      NS              172800  IN      NS              172800  IN      NS              172800  IN      NS              172800  IN      NS
$ dig +noall +question +authority
;                    IN      A

You could hide this from your trace with the +noauthority option, but it would also make the output largely useless as you would be hiding the AUTHORITY section from the intermediate nameservers as well. (which, being delegations, is pretty much all there is to be seen unless you've set +additional)

It is up to individual nameserver implementations whether or not they wish to supply an AUTHORITY section in scenarios where they are not strictly required by RFC. BIND is one of the server implementations that does display this information by default, but it also provides a minimal-responses option for disabling the behavior. I strongly recommend this option in customer facing recursion scenarios as it reduces the overhead of amplification attacks against spoofed source IPs. (sadly, BCP 38 is not as widely implemented as it needs to be)

From the BIND ARM:

If yes, then when generating responses the server will only add records to the authority and additional data sections when they are required (e.g. delegations, negative responses). This may improve the performance of the server. The default is no.

share|improve this answer

With +trace, dig will go ahead and query the actual nameservers of the domain. So the response you're seeing is not from your local DNS resolver, but rather from the actual 'masters' of the domain.

If we look at and, we use and as nameservers respectively. Querying google's nameserver for will reveal 12 A records with IP's, while querying yahoos nameserver for will reveal 3 A records, 6 NS records and some more.

There is no need to use +trace. You can query the servers directly using a combination of dig ns (to find nameservers) and then dig (to query the domain using

This behaviour is determined by the DNS server in question. For example, if I query through a Windows DNS server, I will get only the A records, but if I do the same through a local BIND instance, I will get a plethora of authority records. This question, DNS answer with/without authority, additional sections, touches on the same topic, but they also haven't found a setting that controls it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.