<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>I uncovered an oddity in my zone definitions, which I'm trying to
wrap my head around.</p>
<p>We have authority over state.ak.us, which we publish as a public
zone. We also publish challenge.state.ak.us as a public zone.</p>
<p>The public NS records for state.ak.us are: ns4.state.ak.us and
ns3.state.ak.us The NS records for challenge.state.ak.us are the
same.</p>
<p>I recently noticed there were no NS records <u>in the
state.ak.us zone</u> for challenge.state.ak.us. This had me
scratching my head . . "how can this be working?", until I
remembered the same instances of BIND were serving out both zones.
There <u>were</u> NS records in the challenge.state.ak.us zone,
BIND had them, was authoritative, so would answer with them; BIND
didn't need to look in the state.ak.us zone to find them.<br>
</p>
<p>Some experimentation shows that even if I insert NS records into
state.ak.us (for challenge.state.ak.us), BIND does not add them to
its answer when asked "dig NS challenge.state.ak.us". I interpret
this to mean that while this instance of BIND is authoritative for
both zones, it answers with information from the most specific
zone it has, and ignores values in the delegating zone. And that
makes sense to me.</p>
<p>Now the question is, should I insert NS records into state.ak.us
(for challenge.state.ak.us) anyway? Arguments in favor:</p>
<ul>
<li>Every other zone we delegate is handled by some other set of
name serves, so we've come to accept (and expect) "every
delegated zone will have NS records here". This outlier had me
scratching my head, and will cause someone else confusion in the
future.</li>
<li>The time may come when challenge.state.ak.us is not handled by
the same instance of BIND as state.ak.us. Having benign
delegation records present, will remind Future-Self to adjust
the values to delegate to the new servers.</li>
<li>We parse the state.ak.us zone file to identify all delegated
zones, and run periodic tests to confirm those delegates are
delivering coherent answers. With no NS records for
challenge.state.ak.us, we have not been performing these tests.</li>
</ul>
<p>Arguments against:</p>
<ul>
<li>Maybe I misunderstand, and such NS records aren't actually
benign</li>
</ul>
<p>Unknown:</p>
<ul>
<li>Does the answer change if we want to start signing either
zone?<br>
</li>
</ul>
<pre class="moz-signature" cols="72">--
--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
</body>
</html>