0

How I can parse NS from authority - no from child NS servers? I need check NS servers from about 30 000 domains with different TLDs.

I can use

dig google.cz +trace

But output is long and I don't know how I parse only records from TLD authority.

Shorthed example:

cz.                     86400   IN      DS      20237 13 2 CFF0F3ECDBC529C1F0031BA1840BFB835853B9209ED1E508FFF48451 D7B778E2
cz.                     86400   IN      RRSIG   DS 8 1 86400 20181230050000 20181217040000 2134 . ijhIVdbr1fUXUBAG2566vWghRwm3xgdw+WlHT9tL95OELg0IvLR4RHrZ EKUekwm9uH5L4ZxhLbRKnjhgb6zbbgk4r7wXp60VpazhfXJyiNmpW2ln ngK8S+cMdeS/0TnGzswTNbHvWeb53q4AjMn2N34NMe5WdHxORkq2XUi5 zKS7RCMiCYNGblkuiWYxw3Szg4wn4NJEw6nf7spRNTj0nT/HWMXv1c87 q7Mns+gL6OhM0P8391KFHTiZUb5JFytRoRPsQdM2OM03nbzWpG7tKx8V tDRrcSpg4VWM1BRDkhiaaByCih5nTL9vZzALPhF+pxt1DS8c3IyNsoGH WsSOdQ==
;; Received 620 bytes from 199.7.91.13#53(d.root-servers.net) in 116 ms
----------------- THIS I NEED ---- >>>>>>
google.cz.              3600    IN      NS      ns1.google.com.
google.cz.              3600    IN      NS      ns2.google.com.
google.cz.              3600    IN      NS      ns3.google.com.
google.cz.              3600    IN      NS      ns4.google.com.
<<<<<<<<<<<<------------------------
65s261n1o1m7tkpt4dsmh9me00pulrj5.cz. 900 IN NSEC3 1 0 10 30DDC81B8AA815FC 65S2BI628602CT807L61QVBG9K045QH4 NS
65s261n1o1m7tkpt4dsmh9me00pulrj5.cz. 900 IN RRSIG NSEC3 13 2 900 20181228112151 20181215083556 42928 cz. WlKs6sILJMF3A1Ra1u3ILxFFYAz8USfnybOkO6n2Md5O5ME3WlGaXuFr BjiuKUxsGmTxCQNRLEasC3DglTwnZQ==
;; Received 300 bytes from 194.0.13.1#53(b.ns.nic.cz) in 114 ms

google.cz.              300     IN      A       216.58.201.67
;; Received 43 bytes from 216.239.38.10#53(ns4.google.com) in 39 ms

2 Answers 2

1

I guess you could use this command:

dig +noall +authority +noanswer @a.gtld-servers.net yoursite.com
2
  • Problem is that I have many tlds. I can write list of root NS, but I think that here must be more effective solution for future changes.
    – Pavel
    Dec 17, 2018 at 13:35
  • @Pavel This is the most effective solution, though at this point I'd use a DNS library and not a shell script. You're working with domains in bulk (>30k), which means it's not unreasonable to include logic for identifying all the relevant TLD nameservers prior to processing. That's what recursive DNS servers have to do in order to learn them, and you're not going to get it any more efficient than that. I would also caution against assuming that these are the only relevant nameservers, as some server implementations will shift back and forth between the parent and child NS records.
    – Andrew B
    Dec 18, 2018 at 2:18
0

Child servers are also authoritative. Non-authoritative servers are third-party resolvers, for instance google public DNS 8.8.8.8 for the zones that it doesn't serve as NS for. Furthermore, basically you cannot determine which server from two (or more) is master and which is slave.

Thus I'd say your request is weird.

2
  • Maybe I have bad description. My problem is that i need select domains which don't have NS in authority as we wrote him before. Someone use other hostname for NS with same IP. (e.g. right is ns1.hosting.cz, ns2.hosting.cz, but someone have ns1.partner.cz...). It is because we need change IPs with migrate to new backend.
    – Pavel
    Dec 17, 2018 at 13:37
  • 1
    Child servers are also authoritative. Non-authoritative servers are third-party resolvers. This statement is misleading. Non-authoritative servers are simply DNS servers that do not consider themselves authoritative for a zone and will not return the aa=1 (authoritative answer) flag in their responses. The parent side of the delegation is not authoritative for the child zone and the parent servers will not return the flag in that context. (RFC 2181 § 6)
    – Andrew B
    Dec 17, 2018 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .