My domain registrar and DNS provide currently ignores DNS requests to unknown domains. By ignore I mean black-holes and never responds which causes my DNS clients and resolver libraries to retry, back off, and finally timeout.
dig @NS3.DNSOWL.COM somedomainthatdoesntexist.org ... ;; connection timed out; no servers could be reached
In surveying other popular domain name services, I see that this behavior is pretty unique since other providers return an RCODE of 5 (REFUSED):
dig @DNS1.NAME-SERVICES.COM somedomainthatdoesntexist.org dig @NS-284.AWSDNS-35.COM somedomainthatdoesntexist.org dig @NS21.DOMAINCONTROL.COM somedomainthatdoesntexist.org
All return something like the following:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 64732
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31219
NXDOMAIN immediately is appropriate IMHO as opposed to just dropping the request on the server room floor.
When I complain to my provider about their servers not responding, they ask me to quote the RFC that their servers are violating. I know it's strange that they are asking me to prove that their servers should respond to all requests but so be it.
- It is my stipulation that unless there are duplicate request ids or some sort of DOS response, a server should always respond to the request. Is this correct?
- What RFC and specific section should I quote to support my stipulation?
To me, it is bad to not respond to a DNS query. Most clients will back off and then retransmit the same query to either the same DNS server or another server. Not only are they slowing clients down but they are causing the same query to be done again by their own or other servers depending on the authoritative name servers and NS entries.
In RFC 1536 and 2308 I see a lot of information about negative caching for performance reasons and to stop retransmission of the same query. In 4074 I see information about returning an empty answer with an RCODE of 0 so the client knows there is not ipv6 info which should cause the client to ask about A RRs which is another example of an empty response.
But I can't find an RFC which says that a DNS server should respond to a request, probably because it is implied.
The specific problem happens when I migrate my domain (and the associated DNS records) to their servers or the first X minutes after I register a new domain with their service. There is a lag between the time the authoritative name servers change (which is pretty damn fast these days) and their servers starting serving my DNS records. During this lag time, DNS clients think that their servers are authoritative but they never respond to a request -- even with a
REFUSED. I understand the lag which is fine but I disagree with the decision to not respond to the DNS requests. For the record, I understand how to work around these limitations in their system but I'm still working with them to improve their services to be more in line with the DNS protocol.
Thanks for the help.
Within a couple of months of posting this and following up with my provider, they changed their servers to return
NXDOMAIN for unknown domains.