Stupid question..

[Doug Barton]

PB wrote:
> 
> Hi,
> 
> I probably have a stupid question but I cannot figure out the answer so I
> thought I'd ask it anyway:
> 
> I first noticed this when resolving 'snort.org'.
> 
>   # host -t A snort.org.
> 
>   # host -t A www.snort.org.
>   www.snort.org. has address 151.196.107.166
> 
>   # host -t A nxdomain.snort.org.
>   Host nxdomain.snort.org. not found: 3(NXDOMAIN)
> 
> When doing: "dig @ns1.snort.org. -t A snort.org." I get only the authority
> record, but status: NOERROR
> 
> When doing: "dig @ns1.snort.org. -t A nxdomain.snort.org." I get only the
> authority record, but with status: NXDOMAIN
> 
> So the question is: Why is the first query no error? I ask for the A record
> of snort.org, the nameserver cannot answer this and it still returns
> NOERROR.

	I think the problem lies in your thinking that a lack of answer to the
A record query for the domain should be an error. It might be easier to
understand if we define NXDOMAIN first. That response basically means,
"You asked me a question about a hostname you think I should know
something about, but I don't know anything about it at all, except maybe
some other places for you to look (the authority section)." You would
expect that answer for a completely made up hostname that doesn't
actually exist. However, when you query for the A record of the domain
(the hostname at the top of the zone cut) the answer is different
because the name server does know something about that hostname. It has
at least SOA and NS records for the domain, and maybe more. You can see
what it knows (kind of) by doing a query for 'any'. Therefore, you get
zero answers, and NOERROR. Which basically is the server's way of
saying, "You asked me about this hostname, and I DO know about it, but
there is no answer for your specific query." 

Hope this helps,

Doug
-- 
    "We will not tire, we will not falter, and we will not fail."
	- George W. Bush, President of the United States
          September 20, 2001  

         Do YOU Yahoo!?