Can't configure ADDITIONAL section in a BIND 9.8 authoritative DNS server

Question

Glue records are supposed to be configured in the registrar when the DNS server hostname belongs to the same domain.

It is not exactly my case because I am setting up the DNS server for a domain 'example.com' while the name servers can be resolved using another domain 'mydnsprovider.com'.

Nevertheless, to facilitate and allow the automatic configuration of the glue records in the registrar, I would like to include the A records for the nameservers 'ns1.mydnsprovider.com' like 'additional' records, like this:

; Zone file for example.com
$TTL    3600
example.com.       IN      SOA     example.com.    admin.example.com. (
                     2019053101         ; Serial
                           3600         ; Refresh
                           1800         ; Retry
                         604800         ; Expire
                          43200 )       ; Negative Cache TTL

example.com.   IN      NS      ns1.mydnsprovider.com.
example.com.   IN      NS      ns2.mydnsprovider.com.
example.com.   IN      NS      ns3.mydnsprovider.com.

example.com.       IN      A       x.x.x.x

www     IN      A       x.x.x.x
                MX      10 example.com.  ; Primary Mail Exchanger
                TXT     "Example Systems S.L."


localhost       A       127.0.0.1

example.com.    A       x.x.x.x
host1           A       a.a.a.a
host2           A       b.b.b.b
...

ns1.mydnsprovider.com   IN      A       x.x.x.x
ns2.mydnsprovider.com   IN      A       y.y.y.y
ns3.mydnsprovider.com   IN      A       z.z.z.z

However when I do

dig @localhost example.com.

I do not obtain the additional records:

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.59.amzn1 <<>> @ns1.mydnsprovider.com example.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9999
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;example.com.                  IN      A

;; ANSWER SECTION:
example.com.           3600    IN      A       188.40.142.12

;; AUTHORITY SECTION:
example.com.           3600    IN      NS      ns1.mydnsprovider.com.
example.com.           3600    IN      NS      ns2.mydnsprovider.com.
example.com.           3600    IN      NS      ns3.mydnsprovider.com.

;; Query time: 28 msec
;; SERVER: 188.40.142.12#53(188.40.142.12)
;; WHEN: Fri Jun  7 11:00:07 2019
;; MSG SIZE  rcvd: 113

The A records for 'mydnsprovider.com' are not shown.

I would like to know why and if this is the correct behavior for an authoritative server.

Answer 1

First of all, it's unclear what the actual goal is and it sounds like there could be an XY-problem kind of thing going on here.

Addressing the things you bring up, though, the name ns1.mydnsprovider.com. is not part of the example.com. zone (it cannot be, by definition), and unless the same nameserver happens to also be authoritative for the mydnsprovider.com zone in addition to the example.com zone (which would be a coincidence, not at all a requirement) there is no reason why it would know anything about names such as ns1.mydnsprovider.com. or include data for them in the additional section (not required).

The records at the end of your example.com zone in the question would expand to ns1.mydnsprovider.com.example.com. etc, which is an entirely different name, with no relation to the name in the NS records. (Names without a trailing dot are considered relative.)

Answer 2

Since bind 9.2 (See the release notes here bind defaults to the setting

minimal-responses no-auth-recursive; 

Try setting that to

minimal-responses no;