0000038: Subdomain NS delegation not functioning

(0000088)
itamarjp (developer)
2009-11-07 03:33

for me it's working

http://www.dnswatch.info/dns/dnslookup?la=en&host=test1.phoenixkv.net&type=A&submit=Resolve [^]

(0000089)
fluidns (reporter)
2009-11-07 03:36

When we try to check this via OpenDNS' cache update system, all resolutions fail.

http://www.opendns.com/support/cache/ [^]

We've attempted to pull data from numerous machines, different networks all fail when looking up at the nameserver itself.

(0000090)
fluidns (reporter)
2009-11-07 06:36

[root@sbapgcs02 ~]# nslookup test1.phoenixkv.net
;; Got SERVFAIL reply from 10.1.6.75, trying next server
Server: 10.1.6.75
Address: 10.1.6.75#53

** server can't find test1.phoenixkv.net: NXDOMAIN

[root@sbapgcs02 ~]# nslookup test1.phoenixkv.net ns1.fluidns.com
Server: ns1.fluidns.com
Address: 209.250.2.94#53

*** Can't find test1.phoenixkv.net: No answer

[root@sbapgcs02 ~]#

(0000091)
itamarjp (developer)
2009-11-07 07:17

[itamar@itamar ~]$ nslookup
> set q=any
> test1.phoenixkv.net
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
test1.phoenixkv.net nameserver = ns6.peachydandy.net.
test1.phoenixkv.net nameserver = ns5.peachydandy.net.

Authoritative answers can be found from:
ns6.peachydandy.net internet address = 74.86.9.50
ns5.peachydandy.net internet address = 174.36.198.66
>

what are the problem ?

for me seems to be working.

(0000092)
fluidns (reporter)
2009-11-07 07:20

For you, it is working, however it is not working for anyone using OpenDNS, it is not working for anyone using Qwest DSL in the Southwest US, and it isn't working for anyone using Time Warner Telecom. So, the fact that it is working for you doesn't resolve the overall problem.

When querying the AUTHORITATIVE nameserver itself, it should STILL return a valid answer (forwarding the question on to the delegated nameserver). It isn't doing this.

(0000093)
itamarjp (developer)
2009-11-07 07:23

mydns is authoritative only.

(0000094)
itamarjp (developer)
2009-11-07 07:24

do you know the difference between authoritative and recursive ?

(0000095)
fluidns (reporter)
2009-11-07 07:27

I'm quite aware, thanks. And I understand that MyDNS is authoritative only. What I'm saying is, whatever is happening when YOU query for test1.phoenixkv.net is NOT happening for most others (including myself from multiple diverse networks).

I thought that has been laid out pretty clearly thus far.

When doing an NSLOOKUP against ns1.fluidns.com (the master server for the phoenixkv.net zone) it returns a blank result (or gives No Answer). This occurs when attempting to gather this data from MULTIPLE different servers on MULTIPLE different networks, including OpenDNS' cache system.

(0000096)
itamarjp (developer)
2009-11-07 07:33

[itamar@itamar ~]$ nslookup
> set q=any
> server ns1.fluidns.com
Default server: ns1.fluidns.com
Address: 209.250.2.94#53
> test1.phoenixkv.net
Server: ns1.fluidns.com
Address: 209.250.2.94#53

test1.phoenixkv.net nameserver = ns5.peachydandy.net.
test1.phoenixkv.net nameserver = ns6.peachydandy.net.
>

at the ns1.fluidns.com have only NS records for test1.phoenixkv.net, it's forwarding query's to ns5.peachydandy.net. and ns6.peachydandy.net.

> server ns5.peachydandy.net
Default server: ns5.peachydandy.net
Address: 174.36.198.66#53
> test1.phoenixkv.net
Server: ns5.peachydandy.net
Address: 174.36.198.66#53

test1.phoenixkv.net mail exchanger = 0 test1.phoenixkv.net.
test1.phoenixkv.net
    origin = ns1.arandomserver.com
    mail addr = server.arandomserver.com
    serial = 2009110101
    refresh = 86400
    retry = 7200
    expire = 3600000
    minimum = 86400
test1.phoenixkv.net nameserver = ns1.arandomserver.com.
test1.phoenixkv.net nameserver = ns2.arandomserver.com.
Name: test1.phoenixkv.net
Address: 174.36.238.55
>

and in ns5.peachydandy.net it's forwarding to ns1.arandomserver.com. and ns2.arandomserver.com, also have "A" record pointing to 174.36.238.55

(0000097)
fluidns (reporter)
2009-11-07 07:37

That's fine ... but that doesn't explain this, when not setting the query type to explicitly ANY resource records.

[root@sbapgcs02 ~]# nslookup test1.phoenixkv.net ns1.fluidns.com
Server: ns1.fluidns.com
Address: 209.250.2.94#53

*** Can't find test1.phoenixkv.net: No answer

(0000098)
itamarjp (developer)
2009-11-07 07:40

[itamar@itamar ~]$ nslookup
> set q=any
> server ns1.fluidns.com
Default server: ns1.fluidns.com
Address: 209.250.2.94#53
> test1.phoenixkv.net
Server: ns1.fluidns.com
Address: 209.250.2.94#53

test1.phoenixkv.net nameserver = ns5.peachydandy.net.
test1.phoenixkv.net nameserver = ns6.peachydandy.net.
>

it's because you have only NS records in ns1.fluidns.com

(0000099)
fluidns (reporter)
2009-11-07 07:45

This doesn't explain why, until I query ANY records manually, that OpenDNS, TWT, Qwest, and Global Crossing's resolvers can't resolve test1.phoenixkv.net.

That's not how it should operate normally. When delegating the domain on the nameservers for the TLD, any resolver should auto-follow to the delegated nameservers to pick up the resource records for that subdomain.

This isn't happening.

(0000108)
fluidns (reporter)
2009-12-03 03:12

After enabling a recursive server in the mydns.conf file, when doing an NS lookup against the nameserver ns1.fluidns.com it reports back with the info below. As you notice, it is showing test1.phoenixkv.net.phoenixkv.net which is obviously WRONG.

==

C:\Users\Chris Hesselrode>nslookup test1.phoenixkv.net. ns1.fluidns.com
Server: ns1.phx.fluidns.com
Address: 209.250.2.94

Name: test1.phoenixkv.net
Served by:
- ns5.peachydandy.net

          test1.phoenixkv.net.phoenixkv.net
- ns6.peachydandy.net

          test1.phoenixkv.net.phoenixkv.net

C:\Users\Chris Hesselrode>nslookup test1.phoenixkv.net ns1.fluidns.com
Server: ns1.phx.fluidns.com
Address: 209.250.2.94

Name: test1.phoenixkv.net
Served by:
- ns5.peachydandy.net

          test1.phoenixkv.net.phoenixkv.net
- ns6.peachydandy.net

          test1.phoenixkv.net.phoenixkv.net

C:\Users\Chris Hesselrode>

(0000118)
tlamy (developer)
2009-12-16 16:50

fluidns, could you please add an attachment with the rr and soa records in question? Would make life easier for me tracking the problem down.

(0000119)
tlamy (developer)
2009-12-16 16:51

Please provide us with zone data from your database for testing purposes

(0000120)
tlamy (developer)
2009-12-16 16:54

Seems to be related to <1252047035.4649.8.camel@zion.finsbury.cohtech.co.uk>:

Andreas,

On Thu, 2009-09-03 at 08:19 +0200, info@anbro.de wrote:
> Hi,
>
> I have a zone "example.com" in MyDNS. In that zone I have two NS records
> (for subdomain delegation) like this: "something NS another-dns.com".
> Additionaly there is a wildcard record *.example.com: "* A 1.2.3.4"
> If MyDNS 1.2.8.27 (or lower) gets a query for www.something.example.com,
> it returns the IP 1.2.3.4 and doesn't tell there's another authorized
> DNS for this query.
> However, the query something.example.com works fine everytime.
>
> If the wildcard A record is removed, everything is fine... But the
> wildcard is important and can't be dropped easily.
> So it seems the NS records for subdomain works only for the subdomain
> itself, but not for subdomains under this sub when wildcard * A exists
> because it is more important than the NS records?
>
> Is this a bug in MyDNS?
Yes it is! The wildcard checking currently takes precendence over
delegation. It looks like I put the code in the wrong place when I fixed
the wildcard look ups. I will sort out a patch and publish a new release
as soon as I can.

> Thanks!
>
> Kind regards,
> Andreas
>
--
Howard Wilkinson <howard@cohtech.com>
Coherent Technology Limited

(0000130)
tlamy (developer)
2009-12-22 16:09

Fixed in svn revision 213

Notes
(0000088) itamarjp (developer) 2009-11-07 03:33	for me it's working http://www.dnswatch.info/dns/dnslookup?la=en&host=test1.phoenixkv.net&type=A&submit=Resolve [^]

(0000089) fluidns (reporter) 2009-11-07 03:36	When we try to check this via OpenDNS' cache update system, all resolutions fail. http://www.opendns.com/support/cache/ [^] We've attempted to pull data from numerous machines, different networks all fail when looking up at the nameserver itself.

(0000090) fluidns (reporter) 2009-11-07 06:36	[root@sbapgcs02 ~]# nslookup test1.phoenixkv.net ;; Got SERVFAIL reply from 10.1.6.75, trying next server Server: 10.1.6.75 Address: 10.1.6.75#53 server can't find test1.phoenixkv.net: NXDOMAIN [root@sbapgcs02 ~]# nslookup test1.phoenixkv.net ns1.fluidns.com Server: ns1.fluidns.com Address: 209.250.2.94#53 * Can't find test1.phoenixkv.net: No answer [root@sbapgcs02 ~]#

(0000091) itamarjp (developer) 2009-11-07 07:17	[itamar@itamar ~]$ nslookup > set q=any > test1.phoenixkv.net Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: test1.phoenixkv.net nameserver = ns6.peachydandy.net. test1.phoenixkv.net nameserver = ns5.peachydandy.net. Authoritative answers can be found from: ns6.peachydandy.net internet address = 74.86.9.50 ns5.peachydandy.net internet address = 174.36.198.66 > what are the problem ? for me seems to be working.

(0000092) fluidns (reporter) 2009-11-07 07:20	For you, it is working, however it is not working for anyone using OpenDNS, it is not working for anyone using Qwest DSL in the Southwest US, and it isn't working for anyone using Time Warner Telecom. So, the fact that it is working for you doesn't resolve the overall problem. When querying the AUTHORITATIVE nameserver itself, it should STILL return a valid answer (forwarding the question on to the delegated nameserver). It isn't doing this.

(0000093) itamarjp (developer) 2009-11-07 07:23	mydns is authoritative only.

(0000094) itamarjp (developer) 2009-11-07 07:24	do you know the difference between authoritative and recursive ?

(0000095) fluidns (reporter) 2009-11-07 07:27	I'm quite aware, thanks. And I understand that MyDNS is authoritative only. What I'm saying is, whatever is happening when YOU query for test1.phoenixkv.net is NOT happening for most others (including myself from multiple diverse networks). I thought that has been laid out pretty clearly thus far. When doing an NSLOOKUP against ns1.fluidns.com (the master server for the phoenixkv.net zone) it returns a blank result (or gives No Answer). This occurs when attempting to gather this data from MULTIPLE different servers on MULTIPLE different networks, including OpenDNS' cache system.

(0000096) itamarjp (developer) 2009-11-07 07:33	[itamar@itamar ~]$ nslookup > set q=any > server ns1.fluidns.com Default server: ns1.fluidns.com Address: 209.250.2.94#53 > test1.phoenixkv.net Server: ns1.fluidns.com Address: 209.250.2.94#53 test1.phoenixkv.net nameserver = ns5.peachydandy.net. test1.phoenixkv.net nameserver = ns6.peachydandy.net. > at the ns1.fluidns.com have only NS records for test1.phoenixkv.net, it's forwarding query's to ns5.peachydandy.net. and ns6.peachydandy.net. > server ns5.peachydandy.net Default server: ns5.peachydandy.net Address: 174.36.198.66#53 > test1.phoenixkv.net Server: ns5.peachydandy.net Address: 174.36.198.66#53 test1.phoenixkv.net mail exchanger = 0 test1.phoenixkv.net. test1.phoenixkv.net origin = ns1.arandomserver.com mail addr = server.arandomserver.com serial = 2009110101 refresh = 86400 retry = 7200 expire = 3600000 minimum = 86400 test1.phoenixkv.net nameserver = ns1.arandomserver.com. test1.phoenixkv.net nameserver = ns2.arandomserver.com. Name: test1.phoenixkv.net Address: 174.36.238.55 > and in ns5.peachydandy.net it's forwarding to ns1.arandomserver.com. and ns2.arandomserver.com, also have "A" record pointing to 174.36.238.55

(0000097) fluidns (reporter) 2009-11-07 07:37	That's fine ... but that doesn't explain this, when not setting the query type to explicitly ANY resource records. [root@sbapgcs02 ~]# nslookup test1.phoenixkv.net ns1.fluidns.com Server: ns1.fluidns.com Address: 209.250.2.94#53 *** Can't find test1.phoenixkv.net: No answer

(0000098) itamarjp (developer) 2009-11-07 07:40	[itamar@itamar ~]$ nslookup > set q=any > server ns1.fluidns.com Default server: ns1.fluidns.com Address: 209.250.2.94#53 > test1.phoenixkv.net Server: ns1.fluidns.com Address: 209.250.2.94#53 test1.phoenixkv.net nameserver = ns5.peachydandy.net. test1.phoenixkv.net nameserver = ns6.peachydandy.net. > it's because you have only NS records in ns1.fluidns.com

(0000099) fluidns (reporter) 2009-11-07 07:45	This doesn't explain why, until I query ANY records manually, that OpenDNS, TWT, Qwest, and Global Crossing's resolvers can't resolve test1.phoenixkv.net. That's not how it should operate normally. When delegating the domain on the nameservers for the TLD, any resolver should auto-follow to the delegated nameservers to pick up the resource records for that subdomain. This isn't happening.

(0000108) fluidns (reporter) 2009-12-03 03:12	After enabling a recursive server in the mydns.conf file, when doing an NS lookup against the nameserver ns1.fluidns.com it reports back with the info below. As you notice, it is showing test1.phoenixkv.net.phoenixkv.net which is obviously WRONG. == C:\Users\Chris Hesselrode>nslookup test1.phoenixkv.net. ns1.fluidns.com Server: ns1.phx.fluidns.com Address: 209.250.2.94 Name: test1.phoenixkv.net Served by: - ns5.peachydandy.net test1.phoenixkv.net.phoenixkv.net - ns6.peachydandy.net test1.phoenixkv.net.phoenixkv.net C:\Users\Chris Hesselrode>nslookup test1.phoenixkv.net ns1.fluidns.com Server: ns1.phx.fluidns.com Address: 209.250.2.94 Name: test1.phoenixkv.net Served by: - ns5.peachydandy.net test1.phoenixkv.net.phoenixkv.net - ns6.peachydandy.net test1.phoenixkv.net.phoenixkv.net C:\Users\Chris Hesselrode>

(0000118) tlamy (developer) 2009-12-16 16:50	fluidns, could you please add an attachment with the rr and soa records in question? Would make life easier for me tracking the problem down.

(0000119) tlamy (developer) 2009-12-16 16:51	Please provide us with zone data from your database for testing purposes

(0000120) tlamy (developer) 2009-12-16 16:54	Seems to be related to <1252047035.4649.8.camel@zion.finsbury.cohtech.co.uk>: Andreas, On Thu, 2009-09-03 at 08:19 +0200, info@anbro.de wrote: > Hi, > > I have a zone "example.com" in MyDNS. In that zone I have two NS records > (for subdomain delegation) like this: "something NS another-dns.com". > Additionaly there is a wildcard record .example.com: " A 1.2.3.4" > If MyDNS 1.2.8.27 (or lower) gets a query for www.something.example.com, > it returns the IP 1.2.3.4 and doesn't tell there's another authorized > DNS for this query. > However, the query something.example.com works fine everytime. > > If the wildcard A record is removed, everything is fine... But the > wildcard is important and can't be dropped easily. > So it seems the NS records for subdomain works only for the subdomain > itself, but not for subdomains under this sub when wildcard * A exists > because it is more important than the NS records? > > Is this a bug in MyDNS? Yes it is! The wildcard checking currently takes precendence over delegation. It looks like I put the code in the wrong place when I fixed the wildcard look ups. I will sort out a patch and publish a new release as soon as I can. > Thanks! > > Kind regards, > Andreas > -- Howard Wilkinson <howard@cohtech.com> Coherent Technology Limited

(0000130) tlamy (developer) 2009-12-22 16:09	Fixed in svn revision 213

Issue History
Date Modified	Username	Field	Change
2009-11-07 03:29	fluidns	New Issue
2009-11-07 03:29	fluidns	File Added: mydns-ng_nsdel_bug.txt
2009-11-07 03:33	itamarjp	Note Added: 0000088
2009-11-07 03:36	fluidns	Note Added: 0000089
2009-11-07 06:36	fluidns	Note Added: 0000090
2009-11-07 07:17	itamarjp	Note Added: 0000091
2009-11-07 07:20	fluidns	Note Added: 0000092
2009-11-07 07:23	itamarjp	Note Added: 0000093
2009-11-07 07:24	itamarjp	Note Added: 0000094
2009-11-07 07:27	fluidns	Note Added: 0000095
2009-11-07 07:33	itamarjp	Note Added: 0000096
2009-11-07 07:37	fluidns	Note Added: 0000097
2009-11-07 07:40	itamarjp	Note Added: 0000098
2009-11-07 07:45	fluidns	Note Added: 0000099
2009-12-03 03:12	fluidns	Note Added: 0000108
2009-12-15 12:54	tlamy	Issue Monitored: tlamy
2009-12-16 16:40	tlamy	Status	new => assigned
2009-12-16 16:40	tlamy	Assigned To	=> tlamy
2009-12-16 16:50	tlamy	Note Added: 0000118
2009-12-16 16:51	tlamy	Note Added: 0000119
2009-12-16 16:51	tlamy	Status	assigned => feedback
2009-12-16 16:54	tlamy	Note Added: 0000120
2009-12-22 14:18	tlamy	Relationship added	duplicate of 0000042
2009-12-22 16:09	tlamy	Note Added: 0000130
2009-12-22 16:09	tlamy	Duplicate ID	0 => 42
2009-12-22 16:09	tlamy	Status	feedback => resolved
2009-12-22 16:09	tlamy	Fixed in Version	=> Trunk
2009-12-22 16:09	tlamy	Resolution	open => fixed