michael at rancid.berkeley.edu
Sat Jun 18 23:22:18 UTC 2011
On 06/18/11 15:23, Chris Thompson wrote:
> On Jun 18 2011, Michael Sinatra wrote:
>> In theory, you can insert glue records anywhere above the zone in
>> question. See RFC 2181, section 5.4.1.
>> As an example, glue for the servers adns1.berkeley.edu and
>> adns2.berkeley.edu exist in the root zone.
> For "fj", "hk", and "xn--j6w193g". These are examples of what some
> of the BIND documentation calls "sibling glue".
You forgot "au" :)
And I now recall that the subject of sibling glue has been discussed on
this list a couple years ago.
> Of course, at the root zone level, *all* NS records need either
> "required glue" or "sibling glue", because every single one of them
> is somewhere under the root zone. At least, until the aliens contact
> us and we get the Internet spliced into the Galactinet ..
> Also, the "required glue" + "sibling glue" desideratum is not always
> enough. Consider
> foo.com. NS ns1.bar.net.
> foo.com. NS ns2.bar.net.
> bar.net. NS ns1.foo.com.
> bar.net. NS ns2.foo.com.
> Neither seems to to need glue in either "com" or "net", but without
> either the domains cannot be resolved. This was a significant issue
> when VeriSign changed the way the *.gltd-servers.net responded last
That's a good example (dare I say the canonical one?). I was thinking
of even simpler cases, such as where you are at least a layer below SLD.
baz.org. NS ns1.dns.podunk.edu.
baz.org. NS ns2.dns.podunk.edu.
dns.podunk.edu. NS ns1.dns.podunk.edu.
dns.podunk.edu. NS ns2.dns.podunk.edu.
In theory, you "should" only need glue in podunk.edu, but podunk.edu
isn't under the control of any registry (or registrar for that matter).
If the registrar for baz.org wants to be sure that things are going to
work--and that they will stay working--then you need appropriate glue at
a higher level.
Because registrars (and even registries) can't always control the
immediate parent of the NS, they require registration of the nameserver
to allow for glue to be placed at higher levels.
More information about the bind-users