<div dir="ltr">On Thu, Aug 6, 2015 at 4:16 AM, Lawrence K. Chen, P.Eng. <span dir="ltr"><<a href="mailto:lkchen@ksu.edu" target="_blank">lkchen@ksu.edu</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">So, in running some tests....I found that "dig +trace <a href="http://kstatesports.com" rel="noreferrer" target="_blank">kstatesports.com</a>" would get to <a href="http://ns-1.ksu.edu" rel="noreferrer" target="_blank">ns-1.ksu.edu</a> show couple NSEC3 records and stop.<br></blockquote><div><br>$ dig +short <a href="http://kstatesports.com">kstatesports.com</a> ns<br><a href="http://ns-2.ksu.edu">ns-2.ksu.edu</a>.<br><a href="http://ns-3.ksu.edu">ns-3.ksu.edu</a>.<br><a href="http://ns-1.ksu.edu">ns-1.ksu.edu</a>.<br><br></div><div>Because the <a href="http://kstatesports.com">kstatesports.com</a> name servers are in the edu zone, they are considered "out of bailiwick".  A resolver must resolve those names in order to learn the addresses of the servers it must communicate with for <a href="http://kstatesports.com">kstatesports.com</a> queries.  Thus, <a href="http://kstatesports.com">kstatesports.com</a> depends on ns-{1,2,3}.<a href="http://ksu.edu">ksu.edu</a> resolving (and validating) properly.<br><br></div><div>Cheers,<br></div><div>Casey<br></div></div></div></div>