0

I was wondering why name server record need to be in the zone file, because the delegation is already done by the parent zone. I came across this answer. That answer makes sense, I suppose. Then I proceeded to query the "A" record for a domain with dig.

dig @ns-cloud-d1.googledomains.com. offensivelearning.com a

Great, I got a authoritative answer. However, when I attempt to query the "NS" record for the same domain, querying the name server:

dig @ns-cloud-d1.googledomains.com. offensivelearning.com ns

This time the answer is non-authoritative. Why? I thought all answers from the name server of the domain ought to be authoritative.

Improve this question
2
  • there is additional possible: this or this one that might be related to self-answer it ;-)
    – djdomi
    Jan 22 at 14:13
  • You got an SOA in the AUTHORITY section of your first query, and no ANSWER, because there are no A records at apex (try doing a query for AAAA or for any other record types without records, same answer), but the server helps with the SOA as its last value is called the "Negative TTL" and informs the client for how long to keep the information (that the record does not exists). For records existing the info is in the TTL part of the record returned itself. Note that you get a NOERROR where for the same query of a name below, like foobar you will get NXDOMAIN (and still a SOA)
    – Patrick Mevzek
    Feb 14 at 23:08

1 Answer 1

Reset to default
1

The question doesn't say exactly what the answer looks like, but I suspect that you are misinterpreting what you see rather than not getting an authoritative answer (which is indeed expected).
(If that is not the case, I would suspect that you are doing your tests in an environment where DNS queries are intercepted and sent to a local resolver instead of the nameserver at the destination address, or something like that.)

I get this answer, which is just like what one would expect:

$ dig @ns-cloud-d1.googledomains.com. offensivelearning.com NS +norec

; <<>> DiG 9.18.8 <<>> @ns-cloud-d1.googledomains.com. offensivelearning.com NS +norec
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65042
;; flags: qr aa; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;offensivelearning.com.         IN      NS

;; ANSWER SECTION:
offensivelearning.com.  21600   IN      NS      ns-cloud-d3.googledomains.com.
offensivelearning.com.  21600   IN      NS      ns-cloud-d1.googledomains.com.
offensivelearning.com.  21600   IN      NS      ns-cloud-d2.googledomains.com.
offensivelearning.com.  21600   IN      NS      ns-cloud-d4.googledomains.com.

;; Query time: 14 msec
;; SERVER: 2001:4860:4802:32::6d#53(ns-cloud-d1.googledomains.com.) (UDP)
;; WHEN: Sun Jan 22 14:24:56 UTC 2023
;; MSG SIZE  rcvd: 168

$

Note the aa flag (authoritative answer).

Improve this answer
3
  • I was indeed misinterpreting the response. I thought an authoritative answer would include an authoritative section. But why does dig not include the authority in the authority section when querying for "NS" records.
    – user1720897
    Jan 22 at 15:50
  • 1
    @user1720897 Ok, knowing what the misunderstanding is, I may try to add a note on the different sections in the answer. The short version though: you asked for exactly these NS records, and you get the direct answer to your question in the ANSWER section. The AUTHORITY section contains information about the authority in contexts where that is needed as a byproduct of what you asked for, while the ADDITIONAL section sometimes contains additional related data that was not exactly what you asked for.
    – Håkan Lindqvist
    Jan 22 at 15:59
  • From question: "This time the answer is non-authoritative. " This can't come from observing the sections (AUTHORITY being there or not) but by looking at the aa flag in the header of answer. Presence of aa flag means the answer is authoritative (vs coming from a recursive namesever). How sections are filled is indeed a completely different problem.
    – Patrick Mevzek
    Feb 14 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.