4

I have encountered a domain for which I can sucessfully retrieve a DNS A record. At the same time, however, any public DNS server seems to return empty NS record. The domain in question is bluedriving.com.

I have looked up the domain with the DNSViz tool - but it gives confusing answer as well. How is this possible? Is this a valid DNS setup? I thought it should be impossible for A record to exist without a NS record.

2 Answers 2

10

Non-standard domain parking DNS server

The this-domain-for-sale.com or 52.20.26.87 is a misconfigured authoritative name server, as it does not respond with the same NS records as the parent zone.

It seems like a BuyDomains.com's non-standard solution for domain parking that responds with IN A 207.148.248.143 to just any domain...

  • whether authoritative:

    $ dig bluedriving.com ANY @52.20.26.87 +short
    207.148.248.143
    
    $ dig scholarmarket.com ANY @52.20.26.87 +short
    207.148.248.143
    ns.buydomains.com. bd-operations.namemedia.com. 2016121022 86400 7200 604800 300
    
    $ dig collapsereport.com ANY @52.20.26.87 +short
    207.148.248.143
    ns.buydomains.com. bd-operations.namemedia.com. 2017060510 86400 7200 604800 300
    
  • or not:

    $ dig buydomains.com ANY @52.20.26.87 +short
    207.148.248.143
    
    $ dig serverfault.com ANY @52.20.26.87 +short
    207.148.248.143
    
    $ dig icann.org ANY @52.20.26.87 +short
    207.148.248.143
    
    $ dig fbi.gov ANY @52.20.26.87 +short
    207.148.248.143
    

It also claims to be authoritative for most TLDs, including com, net, org, gov and many country code top-level domains (ccTLD):

$ dig com NS @52.20.26.87 +noall +authority
com. 300 IN SOA ns.buydomains.com. hostmaster.buydomains.com. 115002911 86400 7200 604800 300

Diagnostic steps

Understanding DNSViz

The DNSViz was designed for analyzing DNSSEC, and bluedriving.com is an unsigned domain. That is why it might seem confusing.

   Domain Name: BLUEDRIVING.COM
   . . .
   Name Server: NS.BUYDOMAINS.COM
   Name Server: THIS-DOMAIN-FOR-SALE.COM
   DNSSEC: unsigned

DNSViz visualizes the status of any DNS zone and also lists configuration errors. Thus, it is able to tell what is going on:

The following NS name(s) were found in the delegation NS RRset (i.e., in the com zone), but not in the authoritative NS RRset: ns.buydomains.com, this-domain-for-sale.com

As well as the other errors with the configuration:

  • bluedriving.com zone:
    • The following NS name(s) did not resolve to address(es): ns.buydomains.com
    • The server(s) were not responsive to queries over UDP. (52.4.207.204)
  • bluedriving.com/A:
    • No response was received from the server over UDP (tried 12 times). (52.4.207.204, UDP_-_EDNS0_4096_D_KN)

Using dig +trace

If you run local diagnostics with dig bluedriving.com +trace you can see the same:

  1. One of the .com name servers ([a-m]{1}.gtld-servers.net) responds with:

    bluedriving.com. 172800  IN  NS  ns.buydomains.com.
    bluedriving.com. 172800  IN  NS  this-domain-for-sale.com.
    
  2. There is an error as one of the name servers does not exist:

    couldn't get address for 'ns.buydomains.com': not found
    
  3. The other name server responds with an A record:

    bluedriving.com. 3600    IN  A   207.148.248.143
    ;; Received 60 bytes from 52.20.26.87#53(this-domain-for-sale.com) in 163 ms
    

It only works because it eventually gets an answer (A) from an authoritative name server (over TCP).

Deducing the likely implementation

The implementation behind this seems like a PowerDNS server that has TLD zones with a wildcard A record.

$ dig version.bind CHAOS TXT @52.20.26.87 +short
"PowerDNS Authoritative Server 3.4.7 ([email protected] built 20151103151158 [email protected])"

A PowerDNS server could have many different backends, but despite the data source the records are equivalent to per TLD BIND zones having:

com.   3600  IN  SOA  ns.buydomains.com. hostmaster.buydomains.com. (
                      115002911 86400 7200 604800 300
                      )
*.com. 3600  IN  A    207.148.248.143 
1
  • Thank you, this is an excellent explanation. Thank you especially for the local dig queries to diagnose it. So it is incorrect DNS setup, but it works just barely enough to provide the A answers to any domain.
    – Marek Rost
    Dec 3, 2023 at 9:23
2

It appears that the SOA and other data on this domain has been restricted for privacy. lookup.icann.org shows the nameservers as ns.buydomains.com and this-domain-for-sale.com which are clearly private nameservers; this may have something to do with the SOA being less than visible.

2
  • There is no such thing as restricting SOA for privacy; the WHOIS (owner / admin / tech) contact information for the domain is REDACTED FOR PRIVACY, but the SOA is not part of that, but a DNS concept. Dec 3, 2023 at 10:13
  • 1
    The name server this-domain-for-sale.com claims it is authoritative for entire .com: com. 300 IN SOA ns.buydomains.com. hostmaster.buydomains.com. 115002911 86400 7200 604800 300. It is a misconfigured or a non-standard authoritative name server. The purpose of it as well as the technical details are explained in my answer. Dec 3, 2023 at 10:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .