DNS Tracing

[D. J. Bernstein]

Kevin Darcy writes:
> BIND doesn't really have a tracing tool like that (although I understand
> that the "dnscache" package from Dan Bernstein does have such a tool).

After you install http://cr.yp.to/djbdns.html:

   % dnstrace any ecs1.altamente.com `cat /usr/local/etc/dnscache/@` | less
   ...
   255 ecs1.altamente.com 198.41.0.4
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 192.112.36.4
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 206.222.97.82
                                   ecs1.altamente.com 86400 A 209.12.244.241
   255 ecs1.altamente.com 206.222.97.50
                                   ecs1.altamente.com 86400 A 209.12.244.241
   255 ecs1.altamente.com 209.12.255.34
                                   ecs1.altamente.com 86400 A 209.12.244.241
   255 ecs1.altamente.com 198.17.208.67
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 198.41.0.21
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 195.8.99.11
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 198.41.3.38
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 210.176.152.18
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 216.33.75.82
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 205.188.185.18
                                   ecs1.altamente.com 172800 A 209.12.224.11
   255 ecs1.altamente.com 192.36.144.253
                                   ecs1.altamente.com 172800 A 209.12.224.11
   ...

On the screen there's highlighting to show that the first couple of
results are from root servers, the next few are from altamente.com
servers, and the rest are from .com servers.

This is only a small part of the dnstrace output. There are hundreds of
servers that have indirect control over *.com; dnstrace will track down
all sorts of inconsistencies more subtle than the one shown above.

---Dan