- NANOG - lists.nanog.org

RE: How common is lack of DNS server diversity?
by Roeland Meyer 28 Jan '01

28 Jan '01

Then, how do you intelligently talk about the other entities I bring up? BTW, I didn't invent some of this. The semantic need exists and because of resistance to further definition, folks are making their own semantics to fill the vacume. You really ought to look at what MSFT uses for DDNS semantics, it is a nightmare. The reason that they came up with their own, is because there were no pre-existing semantics that would cover the concepts. MHSC, ORSC, and I suspect uDNS, had to do the same thing. One resultant is, that we have conflicting semantics. ref: what I said about routing around the problem. Denial is not a river in Egypt and won't make the problem go away. > -----Original Message----- > From: Havard.Eidnes(a)runit.sintef.no > [mailto:Havard.Eidnes@runit.sintef.no] > Sent: Saturday, January 27, 2001 2:29 PM > To: rmeyer(a)mhsc.com > Cc: bmanning(a)vacation.karoshi.com; joshua(a)roughtrade.net; > nanog(a)merit.edu > Subject: Re: How common is lack of DNS server diversity? > > > > > <Root server> ::= Any DNS server that has final authority for a > > <domain tier/level>; > > That's what's commonly referred to as an "authoritative name > server" for the zone in question. > > I'll side with Bill M: a "root DNS name server" serves the root > zone, aka. ".". > > Regards, > > - Håvard >

3 2

RE: How common is lack of DNS server diversity?
by Roeland Meyer 28 Jan '01

28 Jan '01

> > More interestingly, how many root servers allow recursive lookup? > > a quick looping probe shows that none of them do, nor the gTLD servers > (phew!) although L.ROOT-SERVERS.NET and H.GTLD-SERVERS.NET > are unreachable > from my view. Preparing an accurate list of all TLD servers > glued in the > root zone will take a little longer. I was taking about root servers at ALL levels, not just the root.

3 2

RE: How common is lack of DNS server diversity?
by Roeland Meyer 28 Jan '01

28 Jan '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Saturday, January 27, 2001 2:35 PM > On Sat, Jan 27, 2001 at 02:34:58PM -0800, Roeland Meyer wrote: > > > > > Roeland, do you make this shit up as you go along, or what? > > > > Nope, these are agreed upon concepts, just not from the IETF. > > Agreed-upon by whom? The voices in your head? You obviously don't understand the difference between "concept" and "definition". www.open-rsc.org www.dnso.net www.icann.org www.dnso.org BTW, that makes two, personal insults are to be directed at null(a)root-service.net from now on.

5 4

RE: How (un)common is lack of DNS server diversity?
by Roeland Meyer 28 Jan '01

28 Jan '01

> From: woods(a)weird.com [mailto:woods@weird.com] > Sent: Saturday, January 27, 2001 3:38 PM > [ On Saturday, January 27, 2001 at 14:40:39 ( -0800), Roeland > Meyer wrote: ] > > Subject: RE: How common is lack of DNS server diversity? > > > > Then, how do you intelligently talk about the other > entities I bring up? > > An "authoritative nameserver" is, well, an authoritative nameserver. > Nothing more, nothing less. If it's registered (in the > parent zone, or > the root cache/hints file in the case of a top level zone) > but it's not > actually answering authoritatively (but it is answering) then it's > considered to be "lame". Actually, in /bind/contrib, there are programs to chase down and email hostmaster of lame servers. They are considered not-acceptable. BIND also err-logs these, explicitly. > Everything else describes the relationship of the zone to the root > (eg. "top level domain", "second level domain", etc.). > People who want to ascribe some meaning to who's responsible > for shared > top (or sometimes second) level zones talk about "global top level > domains" and "country code top level domains" or maybe "second level > country code domains", though none of these descriptions are > technically > meaningful in any way whatsoever -- they simply ascribe administrative > descriptions to ordinary top level (or maybe second level) > domain names. > > What more could you possibly need!?!?!?!? That's overly simplistic. Put a recursive SLD server up and see how fast the cache gets munged. > The only confusing terms that have been used repeatedly everywhere and > by most everyone at one time or another are "primary" and "secondary" > nameservers (especially when they give the impression that > there's only > one "secondary" nameserver). The new BIND documentation suggests the > much better terms "master" and "slave". There's only one > master, and it > might not even be registered or visible (though BIND's named will > complain if the master listed in the SOA isn't also listed as > one of the > NS records). There can be many slaves, and not all of them need to be > registered or visible either. Both the master and all of the slaves > will always answer authoritatively (at least to anyone who can reach > them and who they permit to query them). Either way if they're listed > in publicly visible NS records, either in their parent zone, or within > the zone, they'd damn well better answer authoritatively! Agreed. > This is not rocket science -- it's very very very simple > stuff! Anyone comfortable with keeping lists of things and understanding > hierarchical relationships between those lists can do DNS in their sleep once they > learn a half dozen very simple rules. I can almost agree. But the existance proof against this point is the ICANN. > I believe the reason that Internet DNS is in such a sorry state is > literally because it is so boringly simple yet particular > about the tiny > details that only an accountant-type personality would care about. We > need more accountants to do the DNS! :-) Interesting that you bring up accountancy, there is a fair amount of $$$ invloved here.

1 0

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> Roeland, do you make this shit up as you go along, or what? Nope, these are agreed upon concepts, just not from the IETF.

3 2

Hidden name servers?
by Sean Donelan 27 Jan '01

27 Jan '01

How do I get name servers added to the COM TLD zone file which are not listed in the NSI Registry WHOIS database? Domain Name: MICROSOFT.COM Registrar: NETWORK SOLUTIONS, INC. Whois Server: whois.networksolutions.com Referral URL: www.networksolutions.com Name Server: DNS4.CP.MSFT.NET Name Server: DNS5.CP.MSFT.NET Name Server: DNS7.CP.MSFT.NET Name Server: DNS6.CP.MSFT.NET Updated Date: 24-jan-2001 Name Server LookUp for microsoft.com Search Type: NS - Authoritative name server Name Server: a.root-servers.net Header: ID=29916, QR=Response, Opcode=QUERY, RCODE=NO ERROR Authoritative Answer=No, Truncation=No Recursion Desired=Yes, Recursion Available=No QDCOUNT=1, ANCOUNT=8, NSCOUNT=0, ARCOUNT=8 Question: Name=microsoft.com, QTYPE=NS, QCLASS=1 Answer Section: - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=18 Name Server=DNS4.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=7 Name Server=DNS5.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=7 Name Server=DNS7.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=7 Name Server=DNS6.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=20 Name Server=Z1.MSFT.AKADNS.COM - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=5 Name Server=Z2.MSFT.AKADNS.COM - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=5 Name Server=Z6.MSFT.AKADNS.COM - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=5 Name Server=Z7.MSFT.AKADNS.COM Additional Records Section: - Name=DNS4.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.11 - Name=DNS5.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.12 - Name=DNS7.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.21 - Name=DNS6.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.20 - Name=Z1.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=216.32.118.104 - Name=Z2.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=32.96.80.17 - Name=Z6.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.229.152.20 - Name=Z7.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=213.161.66.158

3 2

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> > BTW, I consider RFC2870 antiquated > > Is it antiquated because it does not use the Roeland Meyer > definition of > "root server"? No, it is antiquated because of the reasons which I stated, and you cut out.

1 0

RE: How common is lack of DNS server diversity?
by Sean Donelan 27 Jan '01

27 Jan '01

On Sat, 27 January 2001, Roeland Meyer wrote: > <Root server> ::= Any DNS server that has final authority for a <domain > tier/level>; Wouldn't a better term be "authoritative server"? It states what it is, and doesn't have the semantic overload of your use of "root server." Unless, of course, you are in marketing in which case you want semantic overload such as Microsoft's use of "Digital Nervous System" (DNS) to create confusion. Root Server == An authoritative server for the "." (root) of the domain name system TLD Server == An authoritative server for a Top Level Domain, such as the generic TLDs (COM, EDU, INT) and country code TLDs (CA, AU, ZA)

1 0

RE: How common is lack of DNS server diversity?
by Tony Rall 27 Jan '01

27 Jan '01

Regarding "search", I was simply referring to the commonly used dns terminology referring to the "search list". See /etc/resolv.conf on any unix system or "DNS and Bind V3", page 102. Wait a minute, I see where your usage may have originated. W95 network config refers to the nameserver list as "DNS Server Search Order", and to the domain list as the "Domain Suffix Search Order". MS doesn't use this wording in W2k. As far as specifying multiple nameservers (the "nameserver" directive in resolv.conf, or "DNS server addresses" in Win2k), as I said before I tested it and it worked fine in Win2k. Test procedure: Under "Advanced TCP/IP Settings", DNS tab, remove all nameserver addresses, add the address of a non-existent machine, add the address of a working nameserver. Reboot (if you're not doing this with Netswitcher). Test. All services work fine. Nslookup gives you an idea about what is happening under the covers: C:\>nslookup trall2 DNS request timed out. timeout was 2 seconds. *** Can't find server name for address 9.1.25.192: Timed out <- the non-existent nameserver Server: hawk.almaden.ibm.com Address: 9.1.8.254 <- the working nameserver Name: trall2.almaden.ibm.com Address: 9.1.77.83 Nslookup will retry the nameserver list each time, resulting in a resolution delay. But the IP stack resolver remembers which server is working and doesn't retry the bad ones unless needed - there is no resolution delay. Feel free to test this on any other operating system and report your results. Tony Rall Roeland Meyer <rmeyer(a)mhsc.com> on 2001-01-27 11:10:34 To: Tony Rall/Almaden/IBM@IBMUS, Roeland Meyer <rmeyer(a)mhsc.com> cc: nanog(a)merit.edu Subject: RE: How common is lack of DNS server diversity? > From: Tony Rall [mailto:trall@almaden.ibm.com] > Sent: Saturday, January 27, 2001 10:54 AM > > >MS DNS, WinNT4 and below, have broken search algorithm > implementations. > >DDNS, Win2K, is currently untested. > > Search algorithm? I thought we were talking about making > full use of the > dns server list - i.e., if first server doesn't respond try > the next one in > the list. I think, *that* is called a search algorithm. Try it at root level, with WinNT, you'll find that it doesn't work. Better yet, try it with BIND8 (*nix, of course) too, and compare the results. If your test doesn't produce the same results, please send test-plan, scripts, and methods to me. I'd be very interested.

1 0

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> From: Tony Rall [mailto:trall@almaden.ibm.com] > Sent: Saturday, January 27, 2001 10:54 AM > > >MS DNS, WinNT4 and below, have broken search algorithm > implementations. > >DDNS, Win2K, is currently untested. > > Search algorithm? I thought we were talking about making > full use of the > dns server list - i.e., if first server doesn't respond try > the next one in > the list. I think, *that* is called a search algorithm. Try it at root level, with WinNT, you'll find that it doesn't work. Better yet, try it with BIND8 (*nix, of course) too, and compare the results. If your test doesn't produce the same results, please send test-plan, scripts, and methods to me. I'd be very interested.

1 0