My understanding is that if I have the nameservers for both example1.com and example2.us set to ns1.example2.us and ns2.example2.us, looking up www.example1.com will:
- look up example1.com to find its nameservers, yielding no glue records (.com registry won't provide glue for .us domains)
- look up ns1.example2.us and ns2.example2.us (necessarily both?), each of which will:
- query example2.us, yielding glue records for ns1.example2.us and ns2.example2.us
- apparently query ns1.example2.us and/or ns2.example2.us to get the address(es) for ns1.example2.us and/or ns2.example2.us (is this correct? this seemed to be my experience)
- query ns1.example2.us and/or ns2.example2.us to get the address for www.example1.com
If instead, we have the nameservers for both example1.com and example2.com set to ns1.example2.com and ns2.example2.com, looking up www.example1.com will:
- look up example1.com to find its nameservers, yielding glue records for ns1.example2.com and ns2.example2.com
- query ns1.example2.com and/or ns2.example2.com to get the address for www.example1.com
Am I correct that in this case, there are only these two steps in the lookup? Specifically, I seem to be experiencing a volume of lookups in example2.com that suggests that lookups for example1.com are not always using the glue records, resulting in an extra step where ns1.example2.com and/or ns2.example2.com are looked up by querying ns1.example2.com and/or ns2.example2.com.
(edited to highlight my minor questions buried in the first example and to try to clarify my primary question at the end.)
Maybe some diagrams will help, since I think I'm explaining this badly. Here's my understanding of what should happen when looking up www.example.com if example.com's nameservers are ns1.host.us and ns2.host.us:
The third lookup step seems to be happening nearly universally, but doesn't entirely make sense to me. Should that third step really be there?
Here's my understanding of what should happen when looking up www.example.com if example.com's nameservers are ns1.host.com and ns2.host.com:
Is my understanding of this case correct?
Here's what I think might be happening with around 1/3 of the lookups for www.example.com with nameservers ns1.host.com and ns2.host.com (based on the number and timing of queries to the nameservers for various domains):
Is this actually possible and/or does it represent a badly-behaved client?