Beat me to it.. Bleh. Though I will admit, this reminds me of a very painful experience when I got my first dedicated server back in 1999. Death me to BIND. Glad I'm not a DNS admin :) //warren -----Original Message----- From: Scott Howard [mailto:scott@doc.net.au] Sent: Thursday, May 28, 2009 10:12 PM To: Anton Zimm Cc: nanog@nanog.org Subject: Re: glue record Did you check the "ADDITIONAL SECTION" in what you've pasted below? Scott. On Thu, May 28, 2009 at 11:06 PM, Anton Zimm <anton.zimm@gmail.com> wrote:

Hi, I'm looking for glue record for ns1.push.mobi so I ask one of the root

name server. It gives me the list of dot mobi authorized name servers.

I'm expecting it to be answered by one of the mobi tld authorized name

servers, but it's telling me that it delegates the answer to ns1.push.mobi instead. It does not make sense for me because how can I

ask ns1.push.mobi if I don't know its ip address yet... Clue please..?

----- az@hollywood:~$ dig @B2.MOBI.AFILIAS-NST.ORG. ns1.push.mobi ....

;; QUESTION SECTION: ;ns1.push.mobi. IN A

;; AUTHORITY SECTION: push.mobi. 86400 IN NS ns1.push.mobi. push.mobi. 86400 IN NS ns2.push.mobi.

;; ADDITIONAL SECTION: ns1.push.mobi. 86400 IN A 117.102.248.2 ns2.push.mobi. 86400 IN A 117.102.248.3 -----

best, Anton.

* Anton Zimm:

I did see the info from additional section, but:

Afaik the additional section is not an answer, they're just additional info, not an authorized answer from the queried name server. I'm expecting to get a reply for my 'A' query in the 'answer section'.

The MOBI. servers are not authoritative for PUSH.MOBI., so returning data from PUSH.MOBI. in the answer section would be wrong. (ATLAS does this, but this doesn't make it right.)

Now, from the 'authority section' dig is telling me that I can get the authorize answer from ns1.push.mobi. But isn't that circular dependency?

That's why the address is in the additional section. -- Florian Weimer <fweimer@bfk.de> BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstraße 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99

On 2009/05/29 09:48 AM Anton Zimm wrote:

On Fri, May 29, 2009 at 2:16 PM, Florian Weimer <fweimer@bfk.de> wrote:

...

* Anton Zimm:

...

I did see the info from additional section, but:

Afaik the additional section is not an answer, they're just additional info, not an authorized answer from the queried name server. I'm expecting to get a reply for my 'A' query in the 'answer section'.

The MOBI. servers are not authoritative for PUSH.MOBI., so returning data from PUSH.MOBI. in the answer section would be wrong.

I get this: MOBI servers are not authoritative for push.mobi zone, ns1.push.mobi is authoritative for it.

But since ns1.push.mobi is inside push.mobi zone, this create circular reference. Afaik to solve this circular dependency, there has to be a Glue record for ns1.push.mobi somewhere in root nameservers or mobi nameservers.

I can not find the Glue Record. Where is the Glue Record?

IN THE ADDITIONAL SECTION!!!!

On Fri, May 29, 2009 at 02:48:33PM +0700, Anton Zimm wrote:

I can not find the Glue Record. Where is the Glue Record?

You've been told where it is. Stop repeating the question. Its answer won't change. james -- The probable future is that in time, the use of the apostrophe-s will become the default for all occurrences of the letter s at the end of a word. So we are soon likely to assume it's normal to see apostrophe's at the end of word's, even though reader's of mature year's might think it suck's. -- Dave Williams, comp.risks.

In message <20090529123246.GB8139@vacation.karoshi.com.>, bmanning@vacation.kar oshi.com writes:

On Fri, May 29, 2009 at 02:48:33PM +0700, Anton Zimm wrote:

...

I get this: MOBI servers are not authoritative for push.mobi zone, ns1.push.mobi is authoritative for it.

But since ns1.push.mobi is inside push.mobi zone, this create circular reference. Afaik to solve this circular dependency, there has to be a Glue record for ns1.push.mobi somewhere in root nameservers or mobi nameservers.

I can not find the Glue Record. Where is the Glue Record?

Anton.

what you are looking for no longer exists. there is no "glue" record per se. As Florian pointed out, a couple of implementations do what you expect, but BIND 4.x varients, esp at the TLD level, are scarce.

BIND 4.x and BIND 8.x were not RFC 1034 compliant in how they returned glue records due to a internal design problem. This problem was fixed in BIND 9 by seperating the cached data from where the zone data was held.

As has been explained to you several times, modern thinking has settled on one (not particularly obvious) way to deal w/ the circular dependence problem. It really is better to only have to think about this problem space in one way.

RFC 1034 says that glue should only be returned in the additional section. There was just a lot of bad implementations. Note: RFC 1034 is incorrect when it says that glue is *only* required when the namesever's name is below the zone cut. That is the case when it is know for certain that glue is needed. There are other delegation patterns that also need glue to be returned. Mark

--bill

-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org

On Fri, May 29, 2009 at 2:36 PM, Scott Howard <scott@doc.net.au> wrote:

On Fri, May 29, 2009 at 12:09 AM, Anton Zimm <anton.zimm@gmail.com> wrote:

...

Now, from the 'authority section' dig is telling me that I can get the authorize answer from ns1.push.mobi. But isn't that circular dependency?

http://en.wikipedia.org/wiki/Domain_name_system#Circular_dependencies_and_gl...

No offense, but a few minutes on Google should be able to tell you far more than you will ever need to know about how glue works (The above URL is the #1 hit for "dns glue")

Scott, I did google and check wikipedia and other sources before posting the initial question. I didn't understand it thoroughly before, I think I understand more now. thank's, Anton.