not resolving from some places?

[Chris Thompson]

On Jul 26 2007, Kirk Bradel wrote:

[lots snipped]
>>>
>>> ;; QUESTION SECTION:
>>> ;www.atosresearch.eu.           IN      A
>>>
>>> ;; ANSWER SECTION:
>>> www.atosresearch.eu.    85642   IN      CNAME   arroyito.atosorigin.es.
>>> arroyito.atosorigin.es. 85646   IN      A       212.170.156.75
>>>
>>> ;; AUTHORITY SECTION:
>>> atosorigin.es.          85646   IN      NS      ns1.atosorigin.es.
>>> atosorigin.es.          85646   IN      NS      ns2.atosorigin.es.
>>> atosorigin.es.          85646   IN      NS      ineco.nic.es.
>>>
>>> ;; ADDITIONAL SECTION:
>>> ns1.atosorigin.es.      85624   IN      A       212.170.156.7
>>> ns2.atosorigin.es.      85624   IN      A       212.170.156.77
>>> ineco.nic.es.           2842    IN      A       194.69.254.2
>>>
[more snipped]
>
>One of the NS appears to be lame.
>
>; <<>> DiG 9.2.4 <<>> +norec @ineco.nic.es. www.atosresearch.eu.
>; (1 server found)
>;; global options:  printcmd
>;; Got answer:
>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56937
>;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0
>
>;; QUESTION SECTION:
>;www.atosresearch.eu.           IN      A
>
>;; AUTHORITY SECTION:
>.                       518400  IN      NS      M.ROOT-SERVERS.NET.
>.                       518400  IN      NS      A.ROOT-SERVERS.NET.
>.                       518400  IN      NS      B.ROOT-SERVERS.NET.
>.                       518400  IN      NS      C.ROOT-SERVERS.NET.
>.                       518400  IN      NS      D.ROOT-SERVERS.NET.
>.                       518400  IN      NS      E.ROOT-SERVERS.NET.
>.                       518400  IN      NS      F.ROOT-SERVERS.NET.
>.                       518400  IN      NS      G.ROOT-SERVERS.NET.
>.                       518400  IN      NS      H.ROOT-SERVERS.NET.
>.                       518400  IN      NS      I.ROOT-SERVERS.NET.
>.                       518400  IN      NS      J.ROOT-SERVERS.NET.
>.                       518400  IN      NS      K.ROOT-SERVERS.NET.
>.                       518400  IN      NS      L.ROOT-SERVERS.NET.
>
>;; Query time: 198 msec
>;; SERVER: 194.69.254.2#53(194.69.254.2)
>;; WHEN: Thu Jul 26 12:49:58 2007
>;; MSG SIZE  rcvd: 248

Not so: ineco.nic.es [194.69.254.2] is authoritative for atosorigin.es.
It's not authoritative for atosresearch.eu (and gives the referral you
show for it), but it was never claimed to be.

You have been confused by the fact that the NS records in the authority
section of the original response were for the target of the CNAME, not
its owner. Join the club: I guess most of us have scratched our heads
over that particular feature of DNS responses at one time or another!

There is actually a strangeness-short-of-lameness about the NS records
for atosorigin.es. In the delegation there is an NS record for "nso.nic.es",
while that in the zone itself has "ineco.nic.es". But both resolve to
194.69.254.2, so this does no serious harm.

-- 
Chris Thompson
Email: cet1 at cam.ac.uk