recursive lookup behavior

[phn at icke-reklam.ipsec.nu]

Joel Fisher <jfisher at wfubmc.edu> wrote:

> An example domain would be heirs-study.org.

Seems served by :
;; AUTHORITY SECTION:
heirs-study.org.        4H IN NS        ncnoc.ncren.net.
heirs-study.org.        4H IN NS        isnet.is.bgsm.edu.
;; ADDITIONAL SECTION:
isnet.is.bgsm.edu.      4H IN A         152.11.118.6
ncnoc.ncren.net.        1d4h47m27s IN A  192.101.21.1

isnet.is.bgsm.edu. ( 152.11.118.6 ) seems to work, but
ncnoc.ncren.net. ( 192.101.21.1  ) won't answer authoritiv.

So this server might be "Lame" and should be reconfigured
to actually be a slave for "heirs-study.org."
(dig output follows ): 
> dig heirs-study.org. soa @192.101.21.1

; <<>> DiG 8.3 <<>> heirs-study.org. soa @192.101.21.1
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; QUERY SECTION:
;;      heirs-study.org, type = SOA, class = IN

;; ANSWER SECTION:
heirs-study.org.        3h23m4s IN SOA  isnet.is.bgsm.edu. dnsmaster.isnet.is.bgsm.edu. (
                                        3               ; serial
                                        4H              ; refresh
                                        1H              ; retry
                                        2W              ; expiry
                                        1D )            ; minimum
 
 
;; AUTHORITY SECTION:
heirs-study.org.        1d3h49m55s IN NS  isnet.is.bgsm.edu.
heirs-study.org.        1d3h49m55s IN NS  NCNOC.NCREN.NET.
 
;; ADDITIONAL SECTION:
isnet.is.bgsm.edu.      1D IN A         152.11.118.6
NCNOC.NCREN.NET.        4H IN A         192.101.21.1
NCNOC.NCREN.NET.        4H IN A         128.109.193.1
 
;; Total query time: 123 msec
;; FROM: warp.ipsec.nu to SERVER: 192.101.21.1
;; WHEN: Tue Apr  2 18:14:14 2002
;; MSG SIZE  sent: 33  rcvd: 187

Note the absense of 'aa' in the flags field.

peter h


> Thanks,

> JOel



> Joel Fisher wrote:
>>=20
>> Am I misunderstanding how the query happens.
>> Shouldn't the nameservers trying to resolve one of our records
> failover
>> to the secondary server if it can't reach the primary?

> Nope that sounds about right - althoug fail over is the wrong
> term - both servers are active and external people can't tell
> which is primary or secondary.

> If you tell us what domains we'll tell you what is wrong.



-- 
Peter Håkanson         
        IPSec  Sverige      (At the Riverside of Gothenburg, home of Volvo)
           Sorry about my e-mail address, but i'm trying to keep spam out.
	   Remove "icke-reklam" and it works.