<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 4/25/2010 12:01 AM, Josh Kuo wrote:
<blockquote
cite="mid:u2q46e76f621004242101q754df797k1dda9e10389e4d70@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div class="h5">You need administrative access to see the overides
to the normal resolution</div>
</div>
process.<br>
<br>
</blockquote>
<div><br>
</div>
<div>Just so I understand this completely, by administrative access
you mean I need to be able to log in to each of the resolvers (not
administrative access on my local workstation to do a 'sudo dig <a
moz-do-not-send="true" href="http://example.net">example.net</a> a
+trace'), correct?</div>
</div>
</blockquote>
+trace only shows the workings of the standard iterative-resolution
algorithm, as if your local resolver, starting with only hardcoded
information about the root zone, were doing all of the work necessary
to obtain the requested information using *non-recursive* queries to
trace the delegation chain(s).<br>
<br>
However, if you send *recursive* queries, essentially giving some other
resolver _carte_blanche_ to resolve the name any way it feels fit, then
+trace isn't going to tell you diddly about whatever
algorithm/configuration the other resolver might be using to get the
information for you. It's basically a "black box" as far as you're
concerned -- queries in, responses out. You don't know how or where it
got the information.<br>
<blockquote
cite="mid:u2q46e76f621004242101q754df797k1dda9e10389e4d70@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div><br>
</div>
<div>A follow up question to that... is it even possible to perform
such a trace (revealing all resolvers) with the DNS protocol? Or is
this purely a designed limitation of dig?</div>
</div>
<br>
</blockquote>
Feel free to propose an equivalent layer to the DNS protocol as ICMP is
to IP/TCP/UDP and get all of the DNS implementations out there to
support the new protocol extension.<br>
<br>
Then it might be possible to write a program analogous to "traceroute"
for DNS.<br>
<br>
- Kevin<br>
<br>
</body>
</html>