<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">I think it would be useful if you read the documentation on the feature before we continue this thread. Guessing what the feature is or isn’t does not help helpful discussion.<div><br></div><div><div style="display: block;" class=""><div style="-webkit-user-select: all; -webkit-user-drag: element; display: inline-block;" class="apple-rich-link" draggable="true" role="link" data-url="https://bind9.readthedocs.io/en/v9_18_9/reference.html#namedconf-statement-minimal-responses"><a style="border-radius:10px;font-family:-apple-system, Helvetica, Arial, sans-serif;display:block;-webkit-user-select:none;width:300px;user-select:none;-webkit-user-modify:read-only;user-modify:read-only;overflow:hidden;text-decoration:none;" class="lp-rich-link" rel="nofollow" href="https://bind9.readthedocs.io/en/v9_18_9/reference.html#namedconf-statement-minimal-responses" dir="ltr" role="button" draggable="false" width="300"><table style="table-layout:fixed;border-collapse:collapse;width:300px;background-color:#E9E9EB;font-family:-apple-system, Helvetica, Arial, sans-serif;" class="lp-rich-link-emailBaseTable" cellpadding="0" cellspacing="0" border="0" width="300"><tbody><tr><td vertical-align="center"><table bgcolor="#E9E9EB" cellpadding="0" cellspacing="0" width="300" style="font-family:-apple-system, Helvetica, Arial, sans-serif;table-layout:fixed;background-color:rgba(233, 233, 235, 1);" class="lp-rich-link-captionBar"><tbody><tr><td style="padding:8px 0px 8px 0px;" class="lp-rich-link-captionBar-textStackItem"><div style="max-width:100%;margin:0px 16px 0px 16px;overflow:hidden;" class="lp-rich-link-captionBar-textStack"><div style="word-wrap:break-word;font-weight:500;font-size:12px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-topCaption-leading"><a rel="nofollow" href="https://bind9.readthedocs.io/en/v9_18_9/reference.html#namedconf-statement-minimal-responses" style="text-decoration: none" draggable="false"><font color="#000000" style="color: rgba(0, 0, 0, 1);">8. Configuration Reference — BIND 9 9.18.9 documentation</font></a></div><div style="word-wrap:break-word;font-weight:400;font-size:11px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-bottomCaption-leading"><a rel="nofollow" href="https://bind9.readthedocs.io/en/v9_18_9/reference.html#namedconf-statement-minimal-responses" style="text-decoration: none" draggable="false"><font color="#A2A2A9" style="color: rgba(60, 60, 67, 0.6);">bind9.readthedocs.io</font></a></div></div></td><td style="padding:6px 12px 6px 0px;" class="lp-rich-link-captionBar-rightIconItem" width="36"><a rel="nofollow" href="https://bind9.readthedocs.io/en/v9_18_9/reference.html#namedconf-statement-minimal-responses" draggable="false"><img style="pointer-events:none !important;display:inline-block;width:36px;height:36px;border-radius:3px;" width="36" height="36" draggable="false" class="lp-rich-link-captionBar-rightIcon" alt="favicon.ico" src="cid:3698A86A-D151-4B90-BBFF-540FFEE53BFB"></a></td></tr></tbody></table></td></tr></tbody></table></a></div></div><br>Thanks,<br><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 14. 12. 2022, at 11:21, Veronique Lefebure <Veronique.Lefebure@cern.ch> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Hi Ondrej,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Thanks for your reply (and sorry for the delay on this on my side).</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Yes, I am aware of the new default for <span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0">the
`minimal-responses` option: we have set it to "no".</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0">But
anyway, if I am not wrong, the minimal-response option controls whether or not the NS records are returned, right ?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0">I have
2 similar DNS servers, one running BIND9.11 and one running BIND9.16 with <b>default </b><span style="background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted1">minimal-response option.</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0"><span style="background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted1 ContentPasted2 ContentPasted3"><br>
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0"><span style="background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted1 ContentPasted2 ContentPasted3">On
the second one, the "AUTHORITY SECTION" and "ADDITIONAL SECTION" are omitted (as expected because of the minimal-response).</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0"><span style="background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted1 ContentPasted2 ContentPasted3"><span style="font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif;margin:0px;background-color:rgb(255, 255, 255)"><span class="ContentPasted0" style="font-size:14px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;margin:0px;background-color:rgb(255, 255, 255);display:inline !important"><span class="ContentPasted1 ContentPasted4 ContentPasted6" style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">But
I can see on both servers that the CNAME and A records are returned in the "ANSWER SECTION".</span></span></span><br class="Apple-interchange-newline ContentPasted4">
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted0"><span style="background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted1 ContentPasted2 ContentPasted3"><br>
</span></span></div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-size: 14px;">So the "<span style="background-color:rgb(255, 255, 255);display:inline !important" class="ContentPasted5">minimal-response" option is not the one controlling whether or not both CNAME and A are turned by dig, right ?</span></span></div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)" class="elementToProof">
Thanks,
<div>Veronique</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Ondřej Surý <ondrej@isc.org><br>
<b>Sent:</b> Monday, October 31, 2022 5:30 PM<br>
<b>To:</b> BIND users <bind-users@lists.isc.org><br>
<b>Cc:</b> Veronique Lefebure <Veronique.Lefebure@cern.ch><br>
<b>Subject:</b> Re: dig +norecurse behaviour changed with 9.16.33</font>
<div> </div>
</div>
<div style="line-break:after-white-space">Since we have already established that this is not a **dig** issue, you might want
<div class="elementToProof">to look at the `minimal-responses` option. The default has changed from `no` to</div>
<div>`no-auth-recursive` in 9.12.0</div>
<div>
<div><br>
</div>
<div>Anyway, the 9.16.0 is doing the right thing because there's a zone cut between</div>
<div>the two names, any resolver still has to revalidate the answer, and there's no</div>
<div>point in appending records that would be thrown away anyway.</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Ondrej<br>
<div>
<div dir="auto" style="color:rgb(0,0,0); letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none; word-wrap:break-word; line-break:after-white-space">
<div style="color:rgb(0,0,0); letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; word-wrap:break-word; line-break:after-white-space">
<div style="word-wrap:break-word; line-break:after-white-space">
<div style="color:rgb(0,0,0); font-family:Helvetica; font-size:12px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">
--</div>
<div style="color:rgb(0,0,0); font-family:Helvetica; font-size:12px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">
Ondřej Surý (He/Him)</div>
<div style="color:rgb(0,0,0); font-family:Helvetica; font-size:12px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">
ondrej@isc.org</div>
<div style="color:rgb(0,0,0); font-family:Helvetica; font-size:12px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">
<br>
</div>
<div style="color:rgb(0,0,0); font-family:Helvetica; font-size:12px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">
My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div>
</div>
</div>
</div>
</div>
<br>
<br>
<div><br>
<blockquote type="cite">
<div>On 28. 10. 2022, at 22:39, Nick Tait via bind-users <bind-users@lists.isc.org> wrote:</div>
<br class="x_Apple-interchange-newline">
<div>
<div>
<p>Hi Veronique.</p>
<p>I'm not an expert, but to me the 9.16 behaviour is what I would expect to happen, based on:</p>
<ul>
<li>When you issue the non-recursive query for "spectrum.cern.ch", it is answered from the "cern.ch" zone, which only knows the CNAME (returned in the ANSWER section) and the NS records for the zone that the CNAME points to (presumably returned in the ADDITIONAL
section?).</li><li>A [hypothetical] subsequent non-recursive query for "spectrum-lb.cern.ch" would be answered from the "spectrum-lb.cern.ch" zone which contains the A records (which should be returned in the ANSWER section of that query).<br>
</li></ul>
<p>(A recursive resolver would be expected to make both of the queries above to give a complete answer to the query for "spectrum.cern.ch".)</p>
<p>But aside from the observation that the responses from 9.11 and 9.16 aren't the same, what is the actual problem you are trying to solve? i.e. Why does it matter if the A record is or isn't returned in a
<i>non-recursive</i> query for "spectrum.cern.ch"?<br>
</p>
Nick.
<p><br>
</p>
<div class="x_moz-cite-prefix">On 28/10/22 01:28, Veronique Lefebure wrote:<br>
</div>
<blockquote type="cite">
<div>Well, </div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">So here a bit more details. </div>
<div class="x_default-style">Sorry, I cannot take an example with a DNS server accessible to you (*) because they have all been upgraded to 9.16.
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">The .cern.ch contains: </div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><span style="font-family:"courier new",courier">spectrum-lb IN NS ip-dns-1.cern.ch.</span>
<br>
<span style="font-family:"courier new",courier">spectrum-lb IN NS ip-dns-2.cern.ch.</span>
<br>
<span style="font-family:"courier new",courier">spectrum IN CNAME spectrum-lb.cern.ch.</span>
<br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">and </div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">spectrum-lb.cern.ch contains: </div>
<div class="x_default-style"><br>
<span style="font-family:"courier new",courier">$ORIGIN .</span> <br>
<span style="font-family:"courier new",courier">$TTL 60 ; 1 minute</span> <br>
<span style="font-family:"courier new",courier">spectrum-lb.cern.ch IN SOA ip-dns-1.cern.ch. internal-dns.cern.ch. (</span>
<br>
<span style="font-family:"courier new",courier">273 ; serial</span> <br>
<span style="font-family:"courier new",courier">3600 ; refresh (1 hour)</span> <br>
<span style="font-family:"courier new",courier">300 ; retry (5 minutes)</span> <br>
<span style="font-family:"courier new",courier">3600000 ; expire (5 weeks 6 days 16 hours)</span>
<br>
<span style="font-family:"courier new",courier">60 ; minimum (1 minute)</span> <br>
<span style="font-family:"courier new",courier">)</span> <br>
<span style="font-family:"courier new",courier">NS ip-dns-1.cern.ch.</span> <br>
<span style="font-family:"courier new",courier">NS ip-dns-2.cern.ch.</span> <br>
<span style="font-family:"courier new",courier">A xxx.xxx.xx.140</span> <br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">named configuration file is identical between 9.11 and 9.16 except for the following options that we have added for 9.16:
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><span style="font-family:"courier new",courier">#BIND916 options</span>
<br>
<span style="font-family:"courier new",courier">qname-minimization disabled;</span>
<br>
<span style="font-family:"courier new",courier">stale-answer-enable no;</span> <br>
<span style="font-family:"courier new",courier">stale-refresh-time 0; #default is 30</span>
<br>
<span style="font-family:"courier new",courier">max-stale-ttl 1w;</span> <br>
<span style="font-family:"courier new",courier">dnssec-policy none;</span> <br>
<span style="font-family:"courier new",courier">synth-from-dnssec no;</span> <br>
<span style="font-family:"courier new",courier">min-cache-ttl 0;</span> <br>
<span style="font-family:"courier new",courier">min-ncache-ttl 0;</span> <br>
<span style="font-family:"courier new",courier">minimal-responses no;</span> <br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">
<div class="x_default-style">(*) On an external DNS server you can try with the following similar case:
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">Running DiG 9.11.21 on a linux client </div>
<div class="x_default-style"> </div>
<div class="x_default-style">ext-dns-1 (<span style="font-family:'courier new',courier">192.65.187.5)
</span>runs BIND9.16: </div>
<div class="x_default-style"> </div>
<div class="x_default-style"><span style="font-family:"courier new",courier">dig @ext-dns-1 foundservices.cern.ch | grep flags | grep ANSWER</span>
<br>
<span style="font-family:"courier new",courier">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1</span>
<br>
</div>
<div class="x_default-style"> </div>
<div class="x_default-style"><span style="font-family:"courier new",courier">dig @ext-dns-1 foundservices.cern.ch
<strong>+norecurse</strong> | grep flags | grep ANSWER</span> <br>
<span style="font-family:"courier new",courier">;; flags: qr aa ra; QUERY: 1, ANSWER:
<span style="color:rgb(255,0,0)"><strong>1</strong></span>, AUTHORITY: 0, ADDITIONAL: 1</span>
<br>
</div>
<div class="x_default-style"> </div>
<div class="x_default-style"> </div>
<div class="x_default-style"><span style="font-family:arial,helvetica,sans-serif">Full output:</span>
</div>
<div class="x_default-style"> </div>
<div class="x_default-style">
<div class="x_default-style"><span style="font-family:"courier new",courier">dig @192.65.187.5 foundservices.cern.ch +norecurse</span>
</div>
<div class="x_default-style"><span style="font-family:"courier new",courier">; <<>> DiG 9.11.21 <<>> @192.65.187.5 foundservices.cern.ch +norecurse</span>
<br>
<span style="font-family:"courier new",courier">; (1 server found)</span> <br>
<span style="font-family:"courier new",courier">;; global options: +cmd</span> <br>
<span style="font-family:"courier new",courier">;; Got answer:</span> <br>
<span style="font-family:"courier new",courier">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9899</span>
<br>
<span style="font-family:"courier new",courier">;; flags: qr aa ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1</span>
</div>
<div class="x_default-style"><span style="font-family:"courier new",courier">;; OPT PSEUDOSECTION:</span>
<br>
<span style="font-family:"courier new",courier">; EDNS: version: 0, flags:; udp: 1232</span>
<br>
<span style="font-family:"courier new",courier">; COOKIE: 8786b980a1a80a7901000000635a7898a512a21aa6138faf (good)</span>
<br>
<span style="font-family:"courier new",courier">;; QUESTION SECTION:</span> <br>
<span style="font-family:"courier new",courier">;foundservices.cern.ch. IN A</span>
</div>
<div class="x_default-style"><span style="font-family:"courier new",courier">;; ANSWER SECTION:</span>
<br>
<span style="font-family:"courier new",courier">foundservices.cern.ch. 900 IN CNAME db-lb-1234.cern.ch.</span>
</div>
<div class="x_default-style"><span style="font-family:"courier new",courier">;; Query time: 2 msec</span>
<br>
<span style="font-family:"courier new",courier">;; SERVER: 192.65.187.5#53(192.65.187.5)</span>
<br>
<span style="font-family:"courier new",courier">;; WHEN: Thu Oct 27 14:24:56 CEST 2022</span>
<br>
<span style="font-family:"courier new",courier">;; MSG SIZE rcvd: 103</span> <br>
</div>
</div>
<div class="x_default-style"> </div>
<div class="x_default-style"> </div>
<div class="x_default-style">ip-dns-0 runs BIND9.11: </div>
<div class="x_default-style"> </div>
<div class="x_default-style"><span style="font-family:"courier new",courier">dig @ip-dns-0 foundservices.cern.ch | grep flags | grep ANSWER</span>
<br>
<span style="font-family:"courier new",courier">;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 4</span>
<br>
</div>
<div class="x_default-style"> </div>
<div class="x_default-style"><span style="font-family:"courier new",courier">dig @ip-dns-0 foundservices.cern.ch
<strong>+norecurse</strong> | grep flags | grep ANSWER</span> <br>
<span style="font-family:"courier new",courier">;; flags: qr aa; QUERY: 1, ANSWER:<span style="color:rgb(255,0,0)">
<strong>2</strong></span>, AUTHORITY: 2, ADDITIONAL: 4</span> <br>
</div>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">Does that help ? </div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">Greg, can I send you a pcap file in a private email ?
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style"><br>
</div>
<div class="x_default-style">Thanks, </div>
<div class="x_default-style">Veronique </div>
<blockquote type="cite">
<div>On 27/10/2022 10:09 Greg Choules <a href="mailto:gregchoules+bindusers@googlemail.com" data-auth="NotApplicable" class="x_moz-txt-link-rfc2396E">
<gregchoules+bindusers@googlemail.com></a> wrote: </div>
<div><br>
</div>
<div><br>
</div>
<div dir="ltr">Hi Veronique.
<div>No, we cannot easily reproduce this behaviour because we have no knowledge of the configs of either of those servers, the details of the zones you have configured, the contents of those zones or of the system on which you are running the dig command.
<br>
<div><br>
</div>
<div>As I said, we need to see everything please: </div>
<div>- Full digs, not +short </div>
<div>- you have specified @ip-dns0 and @ip-dns1 - the full configs of both of those servers please, including zone definitions and contents for where "<a href="http://spectrum.cern.ch/" data-auth="NotApplicable">spectrum.cern.ch</a>" lives as it is not a name
that can be resolved from the public Internet </div>
<div>- a binary pcap file, using the -w option of tcpdump, capturing all port 53 traffic (UDP and TCP) between this machine and both DNS servers.
</div>
<div><br>
</div>
<div>By the way, when using the @<server> option of dig please use explicit IP addresses, not names. If you use a name, then dig first has to resolve that name and the place it will go to do that is resolv.conf. So it is now dependent on your system DNS setup
to get an IP address to send the dig to. </div>
<div>Also, you have specified @<simple_host_name> not @<FQDN>. This suggests to me that in resolv.conf you have a 'search' list. Personally I don't like search lists because they potentially increase the workload of the DNS system generally, lengthen query
times and mean that you can't be sure exactly where an answer came from. </div>
<div><br>
</div>
<div>Thanks, Greg <br>
<br>
</div>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div class="x_gmail_attr" dir="ltr">On Thu, 27 Oct 2022 at 08:08, Veronique Lefebure <<a href="mailto:veronique.lefebure@cern.ch" data-auth="NotApplicable" class="x_moz-txt-link-freetext">veronique.lefebure@cern.ch</a>> wrote:
<br>
</div>
<blockquote>
<div>
<div>Hi all, </div>
<div><br>
</div>
<div>yes, here is a concrete example: </div>
<div><br>
</div>
<div># ip-dns-1 runs BIND 9.16.33: </div>
<div><br>
</div>
<div>dig @ip-dns-1 <a href="http://spectrum.cern.ch/" data-auth="NotApplicable">spectrum.cern.ch</a> +short +norecurse
<br>
<a href="http://spectrum-lb.cern.ch/" data-auth="NotApplicable">spectrum-lb.cern.ch</a>. <------------- Here we get only the CNAME
<br>
</div>
<div><br>
</div>
<div># ip-dns-0 runs BIND 9.11: </div>
<div><br>
</div>
<div>dig @ip-dns-0 <a href="http://spectrum.cern.ch/" data-auth="NotApplicable">spectrum.cern.ch</a> +short +norecurse
<br>
<a href="http://spectrum-lb.cern.ch/" data-auth="NotApplicable">spectrum-lb.cern.ch</a>.
<br>
xxx.xxx.xx.140 <-------- Here we get in addition the IP of <a href="http://spectrum-lb.cern.ch/" data-auth="NotApplicable">
spectrum-lb.cern.ch</a>. <br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>And yes, a capture shows confirms indeed that dig returns less information when the BIND 9.16.33 DNS server is used.
</div>
<div><br>
</div>
<div>I guess you can easily reproduce that behaviour, unless it is due to a mis-configuration bit on our DNS server ?
</div>
<div><br>
</div>
<div>Thanks, </div>
<div>Véronique </div>
<div><br>
</div>
<blockquote type="cite">
<div>On 26/10/2022 21:04 Greg Choules <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" data-auth="NotApplicable">gregchoules+bindusers@googlemail.com</a>> wrote:
</div>
<div><br>
</div>
<div><br>
</div>
<div dir="ltr">Hi Veronique.
<div>As other people have said, more details please. </div>
<div><br>
</div>
<div>To have a complete picture of what is going on, not only would we need to know what your dig tests look like, but also where dig is sending its queries and how that DNS server is configured.
</div>
<div><br>
</div>
<div>You can tell dig to send queries anywhere, using @<server>. However, if you don't use that it will default to using the nameservers in /etc/resolv.conf. So it may be useful to see the contents of that.
</div>
<div><br>
</div>
<div>Wherever dig is sending its queries, we would need to know what that server will do with them. So its configuration would also be useful.
</div>
<div><br>
</div>
<div>Lastly, the best way to see queries and responses, right down to the nuts and bolts, is with a packet capture.
<br>
</div>
<div><br>
</div>
<div>
<div>You thought this was an easy question, huh ;) </div>
<div><br>
</div>
Can you provide at least some of these things, to get started? </div>
<div><br>
</div>
<div>Cheers, Greg </div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Wed, 26 Oct 2022 at 16:41, Veronique Lefebure <<a href="mailto:veronique.lefebure@cern.ch" data-auth="NotApplicable" class="x_moz-txt-link-freetext">veronique.lefebure@cern.ch</a>> wrote:
<br>
</div>
<blockquote>
<div>
<div>Hi, </div>
<div><br>
</div>
<div>dig answer is different between BIND 9.11 and BIND 9.16(.33) when +norecurse option is used.
</div>
<div>Is this documented somewhere ? </div>
<div><br>
</div>
<div>Is there an option that needs to be set so that the behaviour of 9.16 is the same as the one in 9.11.
</div>
<div><br>
</div>
<div>The change is that with 9.16, if the requested name is a CNAME, only the CNAME value is returned by dig, while with 9.11 dig would return both the CNAME value and the IP of the CNAME.
</div>
<div><br>
</div>
<div>Thanks, </div>
<div>Veronique </div>
</div>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" data-auth="NotApplicable" class="x_moz-txt-link-freetext">
https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list
<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/" data-auth="NotApplicable" class="x_moz-txt-link-freetext">
https://www.isc.org/contact/</a> for more information. <br>
<br>
<br>
bind-users mailing list <br>
<a href="mailto:bind-users@lists.isc.org" data-auth="NotApplicable" class="x_moz-txt-link-freetext">bind-users@lists.isc.org</a>
<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" data-auth="NotApplicable" class="x_moz-txt-link-freetext">https://lists.isc.org/mailman/listinfo/bind-users</a>
<br>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
<br>
<fieldset class="x_moz-mime-attachment-header"></fieldset> </blockquote>
</div>
-- <br>
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.<br>
<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
https://lists.isc.org/mailman/listinfo/bind-users<br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div></blockquote></div></body></html>