need another pair of eyes: edu/net (educause?) glue issues?

Michael Hare michael.hare at
Wed Oct 18 18:09:53 UTC 2017


Sorry for the wide blast (and long email), but perhaps some fellow .edu's can help us through this one.

I'm one of the DNS admins for  An academic group on campus has noticed an issue with the delegation, for which two of the listed NS are on campus.

[]$ dig NS +short <------------- on campus  <------------- on campus is authoritative for and return the following correct A records

[]$ dig NS +short | sort 14400   IN      A 14400   IN      A 14400   IN      A        14400   IN      A        14400   IN      A        14400   IN      A

[]$ dig @ NS +short

It appears that there is some bad glue "somewhere" and I'm having trouble finding where it is coming from.

dig +norecurse NS
;; ADDITIONAL SECTION:       172800  IN      A     172800  IN      A  <---------------- WRONG    172800  IN      A <---------------- WRONG

note: local admins have enabled DNS servers on 170.199 and 170.200 as a short term measure until this can be resolved, so if you dig against those incorrect IPs directly you will get an answer (for now).

We have asked the folks to check the delegation and received the following response:  "...  I checked with Namecheap, where is registered, and they say that the glue record values are supplied to the root nameservers by the registrar for the top-level domain where the names are located (, in this case, so Educause/VeriSign) ...."

And this matches my memory as well.  As recent as June 2017 when an NS inside a .edu was also the NS for another domain (for example, a .org), wearing my DNS admin hat I would log into the educause domain portal and add/update glue, the production example being which has NS inside the namespace.

My suspicious is that the glue stuck in gtld is supplied by educause however educause (who recently went through a major facelift of their portal, is claiming no such thing has ever existed.  I'm not convinced, but there is an off chance early senility is setting in.  I have a screenshot from June 2017 (without URL, unfortunately) of our list of "glue" from what I'm 99% sure is the old portal however educause is claiming adamantly (yes, we have escalated a ticket) that my screenshot is not from their old portal.

I see other screenshots on the web of the old website that shows basically the same design theme (color) as my screenshot.  You'll note my screenshot from June 2017 from "somewhere" has the wrong IPs for and

found on web:

For info from an old thread related to a similar thing we did at ~10 years ago:, but I digress.
I can't dump the .edu zonefile and educause (for now) is denying culpability.  My 'dig' foo is weak enough that I can't come up with a damning output to know where to go from here.  Any ideas?


More information about the bind-users mailing list