Verisign fix

[Andrew Gay]

Ian Northeast wrote:
> 
> Dave Lugo wrote:
> >
> >
> > Uhh... this seems a bit odd - I can no longer query for NS records from
> > the root:
> >
> > dlugo at spot> dig ns stk.com
> >
> > ; <<>> DiG 9.2.2rc1 <<>> ns stk.com
> > ;; global options:  printcmd
> > ;; Got answer:
> > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 21648
> > ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
> 
> I'm seeing something similar. Using 9.2.2-P1 on Suse Linux Enterprise
> Server 8 (UL 1.0) kernel 2.4.19, if I issue an NS query for a valid
> domain with an empty cache I get NXDOMAIN:
> 
> ihqs35a1:~ # rndc flush
> ihqs35a1:~ # dig @localhost ibm.com ns
> 
> ; <<>> DiG 9.2.2-P1 <<>> @localhost ibm.com ns
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 56915
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
> 
> But if I then issue an A or MX or something, which works, and try the NS
> again, it works. I too see the "enforced delegation-only" message.
> 
> It does not appear to make any difference whether the domain's
> nameservers are within the domain or not.
> 
> OK this isn't going to break much in real life but it could certainly
> confuse troubleshooting. I'm holding off on implementing this for now.

I see exactly the same thing with 9.2.2-P1.  NS queries for real domains
give NXDOMAIN if the domain has glue records in the parent zone.  Once
you cache the glue (by querying for something else) the query for NS
will work.

Oddly, querying for 'Any' with an empty cache does return the missing
NS RRs.

This might not break much, but it is not correct behaviour.

Andrew