queries to

Mark Andrews marka at
Fri Jul 1 22:47:01 UTC 2016

The load balancers are not RFC compliant.  While NOTIMP is
a valid rcode it was not intended to be returned for normal

If you look at RFC 1034 you should be getting a Name Error (NXDOMAIN)
response. The server can't load records it doesn't implement so it
it sees them it is supposed to reject the entire zone.  If it has
successfully loaded the zone then it returns NXDOMAIN because the
name does not exist.  If the name existed then it should be returning
NOERROR zero answers because the type does not exist.

This is even more so after the publishing of RFC 2929/5395, Domain
Name System (DNS) IANA Considerations, RFC 3597, Handling of Unknown
DNS Resource Record (RR) Types and RFC 6698 The DNS-Based Authentication
of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA.

RFC 2929 (obsoleted by RFC 5395) both define which qtypes are
reserved for meta queries.

RFC 3597 further reinforces NOERROR zero answers for non meta

RFC 6698 further show TLSA to be a normal (not meta) qtype.

Now NOTIMP for meta queries makes sense as they require the server
to do something other than return records of the requested type.

This is further documented in draft-ietf-dnsop-no-response-issue
which I hope will go for last call soon.

The application can work around NOTIMP by requesting A records and
if that returns a NOERROR response then asking for TLSA records.
It requires a extra query if you get a NOERROR response by not for
a NXDOMAIN response.

One should also be asking why anyone is still using a non EDNS aware
servers in 2016.  There is really no excuse for requiring all your
clients to send you two queries when the vast majority of recursive
servers talk EDNS.


In message <1467393884.20170.25.camel at>, Carl Byington writes:
> Hash: SHA512
> Those dns servers answer queries for A records, but return notimpl for
> TLSA queries. And they don't understand edns.
> time dig tlsa
> +noedns
> That runs in .1 or .2 seconds here, talking directly to their server.
> time dig tlsa
> That takes between .9 and 1.5 seconds, talking to the local bind
> 9.10.4-P1 resolver. Looking at tcpdump output, the local resolver asks
> all four servers for the answer twice, both times getting notimpl
> results.
> has two NS records, but (at least as seen
> from here) both names have the same four IPv4 addresses.
> Is there something preventing an ip address merge to only send four
> outgoing queries?
> Version: GnuPG v2.0.14 (GNU/Linux)
> iEYEAREKAAYFAld2p1MACgkQL6j7milTFsHVJACdEa614rKep2fumntitXyHNqGj
> sawAn3I5b6ke9o7eJhgRcaSaQg1h3VLL
> =WiA/
> _______________________________________________
> Please visit to unsubscribe from this list
> bind-users mailing list
> bind-users at
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at

More information about the bind-users mailing list