2

If I execute dig google.com +trace, then I can see that one of the root DNS servers, which holds data for gTLDs, knows that authoritative name servers for google.com are ns2.google.com., ns1.google.com., ns3.google.com. and ns4.google.com.:

google.com.             172800  IN      NS      ns2.google.com.
google.com.             172800  IN      NS      ns1.google.com.
google.com.             172800  IN      NS      ns3.google.com.
google.com.             172800  IN      NS      ns4.google.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20161106045005 20161030034005 6404 com. R+VQ60BPw77hJx5ItvIWyWzbgq9aw5a5rT+wLLOILHNH1TUM+dlSwfux XrAwj6X/U7aWAaa5xsMM+ccAYj+GhJDWw3RnTlc3SVA1GPcRuC/R2dG+ QmAHoKLJ66XVeUoym6c6Gdxyy27vlKuJktDHgHL1G3Kcy8ljw1uBADKI jIs=
S84AE3BIT99DKIHQH27TRC0584HV5KOH.com. 86400 IN NSEC3 1 1 0 - S84CFH3A62N0FJPC5D9IJ2VJR71OGLV5 NS DS RRSIG
S84AE3BIT99DKIHQH27TRC0584HV5KOH.com. 86400 IN RRSIG NSEC3 8 2 86400 20161108054927 20161101033927 6404 com. bB3EZ+7N/iu7yHzAE4S9V1b20upQRV43pU6xjxWZ5OsJqaF0hSu7gxcj ScD+VIItFkPnab17RKTB96CGM6K9kYYvX3GKJjThFg63cXSl2LE7L7Ny BqQnhcCRXr2jfx5+kCtab8bRrCfSfW1UR7OBsj+I1DX21hs4OhNZQsNY ZiM=
;; Received 660 bytes from 192.48.79.30#53(j.gtld-servers.net) in 33 ms

I guess that google.com got into root DNS servers thanks to registrar. How domain registrars update root DNS servers? I guess they can't somehow directly edit those? Or they send their updates and root DNS servers administrators somehow verify those changes? Most likely those are naive and stupid guesses, but I would like to understand how does domain registrar update root DNS servers.

  • That is not the root server(s); .com (and .net) is handled by the 'gtld' servers, in your example as dig clearly shows j.gtld-servers.net . – dave_thompson_085 Nov 7 '16 at 22:52
1
+100

The root zones (zone .), managed by the ICANN, mainly set authoritative dns for TLD (.com, .net, ...).

Each authority responsive for a TLD (Verisign, Afilias, Nominet, AFNIC, ...) can have a different protocol with their own registrars. This can be automatic (using for instance the "Extensible Provisioning Protocol (EPP)" or any custom API they have designed).

Sometimes, for some exotic extensions, it's more artisanal. Some operators may require their registrars to connect to a web based interface, phone, or even use postal mail to ask for the modifications.

1

Root DNS servers have only information about delegations from ICANN to the registry. For example, .net is operated by Verisign so ICANN would have delegated .net to Verisigns name servers.

If you change your domain delegation, say with GoDaddy, they would connect to their facility with Verisign, usually through EPP or another protocol, to request an update that Verisign then performs on their DNS servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.