Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

i'm investigating our BIND's configuration and can not figure out how it is aware of it's next name server to ask for some domain he's not authorative server for...

e.g. home domain is 'workgroup.lan'
lookup dig www.google.com

answer

;; QUESTION SECTION:
;www.google.com. IN A

;; ANSWER SECTION:

[...]

;; AUTHORITY SECTION:
google.com. 87465 IN NS ns1.google.com.

[...]

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Aug 28 15:56:08 2012
;; MSG SIZE rcvd: 220

But who / what told him to ask other name servers? Or does it is the default behaviour?

May it have something to do with that 'root.hint'-file that is responsible for the '.'- (root-) zone containing IPs of root-nameservers?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

You'd have to look at your DNS server config, but assuming you don't have anything like forwarders set up, indeed you're correct that its the root hints file.

DNS is organized into a tree (sort of: for redundancy, nodes are duplicated; so, e.g., there are multiple root nodes). The root hints file tells the server where to find one of the root nameservers (once it finds one, it'll actually get a current list of root nameservers from the one it finds).

It'll then find out from one of the root nameservers a list of nameservers that are authoritative for the com zone. From one of those, it'll find out a list of nameservers authoritative for the google.com zone. From one of those, finally, it'll get the address (A) record for www.google.com. [Actually, www.google.com is a CNAME, but to the same zone, and surely the Google nameservers will return both records at once]

This process is obviously time-consuming, so a lot of caching is employed. There is a good chance that it already knew the address of www.google.com, and just returned it from cache. If not, it probably already knew to ask ns1.google.com, or failing that almost certainly knew where to ask about subdomains of com.

You can use the dnstracer program to see this:

anthony@Zia:~$ dnstracer -4 -o -s . www.google.com
Tracing to www.google.com[a] via A.ROOT-SERVERS.NET, maximum of 3 retries
A.ROOT-SERVERS.NET [.] (198.41.0.4) 
 |\___ e.gtld-servers.net [com] (192.12.94.30) 
 |     |\___ ns4.google.com [google.com] (216.239.38.10) Got authoritative answer [received type is cname] 
 |     |\___ ns3.google.com [google.com] (216.239.36.10) Got authoritative answer [received type is cname] 
 |     |\___ ns1.google.com [google.com] (216.239.32.10) Got authoritative answer [received type is cname] 
 |      \___ ns2.google.com [google.com] (216.239.34.10) Got authoritative answer [received type is cname] 
⋮

If you want to learn a lot more about DNS and in particular about how to use BIND, DNS and BIND, now in its 5th edition, is a good book. You can also pick up the ebook straight from O'Reilly.

share|improve this answer
    
that is just a great answer! thanks alot for the hint to that 'dnstracer' utility, already tried it well. –  Master of Celebration Aug 29 '12 at 7:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.