Home / server / Questions / 258648
Accepted
Prof. Moriarty
Asked: 2011-04-13 00:52:56 +0800 CST

Should BIND return an A record in the ANSWER SECTION for a glue record?

  • 772

I have to delegate test.example.com to third party provider. Using BIND, in the example.com zone file I set up six NS records like this:

test            IN      NS      a.ns.test.example.com.
test            IN      NS      b.ns.test.example.com.
test            IN      NS      c.ns.test.example.com.
test            IN      NS      d.ns.test.example.com.
test            IN      NS      e.ns.test.example.com.
test            IN      NS      f.ns.test.example.com.

They specifically ask for delegating like this. I then set up the glue records:

a.ns.test       IN      A       IP1
a.ns.test       IN      A       IP2
a.ns.test       IN      A       IP3
a.ns.test       IN      A       IP4
a.ns.test       IN      A       IP5
a.ns.test       IN      A       IP6

Now if I query for the A record of a.ns.test.example.com. with dig I get a response with an AUTHORITY SECTION and ADDITIONAL SECTION, but no ANSWER SECTION. I assume this is by design, to avoid lame delegation problems, so that a resolver caches results from the authoritative servers. However, the third party will NOT turn on the service we want from them unless our servers return an A record.

How can I do that with BIND?

domain-name-system

1 Answers

  1. Best Answer

    Records returned as glue are never authoritative and will never appear in the answer section. If the provider just wants to verify that the glue exists, they should see it in the additional section.

    Whoever is running the a-f.ns.test.example.com nameservers will need to add the A or AAAA records in the test.example.com zone since your delegating nameserver cannot.

    BIND will automatically turn A records into glue when they are providing addresses for nameservers for zones you are delegating away. Once you set up a delegation as you have with test.example.com, BIND will treat any A or AAAA records for hosts you're delegating to as glue only.

    Here is a dig with the delegation removed:

    ; <<>> DiG 9.7.0-P1 <<>> +norecurse @0 a.ns.test.example.com a
...
;; flags: qr aa ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;a.ns.test.example.com.     IN  A

;; ANSWER SECTION:
a.ns.test.example.com.  5   IN  A   1.1.1.1

;; AUTHORITY SECTION:
example.com.        5   IN  NS  gir.example.com.

;; ADDITIONAL SECTION:
ns.example.com. 5   IN  A   2.2.2.2

;; Query time: 0 msec

    It is answering authoritatively. Here is the same with only the delegation added (the first block in your question):

    ; <<>> DiG 9.7.0-P1 <<>> +norecurse @0 a.ns.test.example.com a
...
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:
;a.ns.test.example.com.     IN  A

;; AUTHORITY SECTION:
test.example.com.   5   IN  NS  f.ns.test.example.com.
test.example.com.   5   IN  NS  d.ns.test.example.com.
test.example.com.   5   IN  NS  a.ns.test.example.com.
test.example.com.   5   IN  NS  c.ns.test.example.com.
test.example.com.   5   IN  NS  e.ns.test.example.com.
test.example.com.   5   IN  NS  b.ns.test.example.com.

;; ADDITIONAL SECTION:
a.ns.test.example.com.  5   IN  A   1.1.1.1
b.ns.test.example.com.  5   IN  A   1.1.1.2
c.ns.test.example.com.  5   IN  A   1.1.1.3
d.ns.test.example.com.  5   IN  A   1.1.1.4
e.ns.test.example.com.  5   IN  A   1.1.1.5
f.ns.test.example.com.  5   IN  A   1.1.1.6

;; Query time: 0 msec

    Notice the A records for a-f.ns.test are now glue. This is done automatically. Since you are delegating test.example.com, the superordinate nameservers can no longer answer authoritatively for anything in test.example.com. They can, however, return the A records in the zone as glue since they are delegating to them.

    • 3