remote lookup problem

[Joel Uckelman]

Sorry for the long message, but this has me stumped.

I'm having some trouble doing remote lookups for one of my domains, 
ellipsis.cx. When I query my nameserver, charybdis.ellipsis.cx, everything 
seems to work fine:

% dig @charybdis.ellipsis.cx scylla.ellipsis.cx any

; <<>> DiG 9.1.0 <<>> @charybdis.ellipsis.cx scylla.ellipsis.cx any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39818
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 2

;; QUESTION SECTION:
;scylla.ellipsis.cx.            IN      ANY

;; ANSWER SECTION:
scylla.ellipsis.cx.     43200   IN      A       64.109.29.58

;; AUTHORITY SECTION:
ellipsis.cx.            43200   IN      NS      ns2.granitecanyon.com.
ellipsis.cx.            43200   IN      NS      charybids.ellipsis.cx.
ellipsis.cx.            43200   IN      NS      ns1.granitecanyon.com.

;; ADDITIONAL SECTION:
ns1.granitecanyon.com.  133801  IN      A       205.166.226.38
ns2.granitecanyon.com.  133801  IN      A       64.174.110.37

;; Query time: 5 msec
;; SERVER: 64.109.29.57#53(charybdis.ellipsis.cx)
;; WHEN: Sun Jul 22 23:02:50 2001
;; MSG SIZE  rcvd: 161

But when I query any other server, e.g. ns1.ameritech.net, on the same 
thing the lookup fails. (Yet ns1.ameritech.net can still resolve 
ellipsis.cx and charybdis.ellipsis.cx with no trouble!) According to 
ns5.netdns.co.nz, which is authoritative for .cx:

% dig @ns5.netdns.co.nz ellipsis.cx any

; <<>> DiG 9.1.0 <<>> @ns5.netdns.co.nz ellipsis.cx any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54710
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:
;ellipsis.cx.                   IN      ANY

;; ANSWER SECTION:
ellipsis.cx.            86400   IN      NS      NS1.GRANITECANYON.COM.
ellipsis.cx.            86400   IN      NS      NS2.GRANITECANYON.COM.
ellipsis.cx.            86400   IN      NS      CHARYBDIS.ellipsis.cx.

;; AUTHORITY SECTION:
ellipsis.cx.            86400   IN      NS      NS1.GRANITECANYON.COM.
ellipsis.cx.            86400   IN      NS      NS2.GRANITECANYON.COM.
ellipsis.cx.            86400   IN      NS      CHARYBDIS.ellipsis.cx.

;; ADDITIONAL SECTION:
NS1.GRANITECANYON.COM.  84169   IN      A       205.166.226.38
NS2.GRANITECANYON.COM.  84169   IN      A       64.174.110.37
CHARYBDIS.ellipsis.cx.  86400   IN      A       64.109.29.57

;; Query time: 78 msec
;; SERVER: 206.253.214.140#53(ns5.netdns.co.nz)
;; WHEN: Sun Jul 22 23:09:48 2001
;; MSG SIZE  rcvd: 196

This looks correct to me. charybdis is listed as an NS, and the A glue 
record has the correct IP. So why do queries to other nameservers fail? 
What is preventing them from getting the requested records from mine? If 
anyone can spot what the problem is, that would be a big help. I thought I 
understood how this stuff works, but I"m out of ideas at this point.

-- 
J.