Re: dnscache querying wrong (old?) NS sometimes

On 9/11/2009 12:57 AM, Matthew Dempsky wrote:
> I've been issuing A? www.iunkina.com queries every 60 seconds against
> a local dnscache instance for the past 20-some hours (long enough for
> the A records to have expired a few times now), and haven't seen any
> problems.

I think the problem Rihad is referring to is when:

1. example.com has NS to [ab].ns.example.net
2. his dnscache knows things about example.com
3. the example.com owner changes NS to different servers
    but did not follow Step 4 in
    http://cr.yp.to/djbdns/run-server.html#move-zone
4. dnscache continues to ask [ab].ns.example.net for data even
    though the gtld servers are handing out different authoritative
    servers.

The solution is in Step 3 -  dnscache will then query [ab].ns.example.net 
for example.com and either find they are no longer authoritative and/or 
will find new NS data - forcing a fresh lookup.

see http://securepoint.com/lists/html/djbdns/2007-01/msg00033.html

I agree with Charlie Brady (in the thread) that this is a bug in the dns 
rfcs, and that BIND's position on the topic is preferred over dnscache's. 
But i dont think anyone's come up with a patch to change the behavior.


-- 

Jeremy Kister
http://jeremy.kister.net./