2

Recently wondered how root server returns information about domains it doesn't have information about.

I thought that root dns server, for example, a.root-servers.net, doesn't perform recursive queries itself but instead returns referral - RR pointing to nameserver for TLD of the query.

I issued query about twitter.com hoping to get RR about nameservers for com. but got:

dig @a.root-servers.net twitter.com +norecurse

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @a.root-servers.net twitter.com +norecurse
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51937
;; flags: qr ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;twitter.com.           IN  A

;; ANSWER SECTION:
twitter.com.        748 IN  A   104.244.42.65
twitter.com.        748 IN  A   104.244.42.193

;; Query time: 27 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Thu Dec 29 17:54:09 MSK 2016
;; MSG SIZE  rcvd: 61

Could you explain why root server returns IP of Twitter, it seems that it should return referral only?

Correct me if I'm wrong. Thanks.

9
  • 2
    The big question is how can your machine produce that weird result. I confirmed (although I knew before running it), that I get the same output as DopeGhoti.
    – Julie Pelletier
    Dec 29, 2016 at 15:41
  • 1
    The more I think about it, the more I'm convinced it can only be two things: either you are making a mistake we don't see or your connection is hijacked. Try ping a.root-servers.net to get its IP address. It gives me 198.41.0.4. Is it the same for you?
    – Julie Pelletier
    Dec 29, 2016 at 15:45
  • 1
    I agree with @DopeGhoti, I can not replicate this. However we may be using different a.root-servers.net, see a.root-servers.org (org, not net) for some details.
    – icarus
    Dec 29, 2016 at 15:47
  • 2
    In that case, there is a high probability that your port 53 (DNS query) is filtered and hijacked upstream (your local connection, ISP, or government).
    – Julie Pelletier
    Dec 29, 2016 at 15:55
  • 1
    There are a number of things here. 1. Does it matter? It isn't part of any specification I know that the root nameservers can't return correct data. 2. Is the data correct? This is what en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions is all about. 3. Whilst everyone agrees that 198.41.0.4 is the IP address, this is a number of different machines around the world. Which one you connect to depends on your ISP and thier routing tables. Perhaps you need a VPN to effectively connect you to a different ISP.
    – icarus
    Dec 29, 2016 at 16:28

2 Answers 2

Reset to default
4

Unable to replicate:

$ dig @a.root-servers.net twitter.com +norecurse

; <<>> DiG 9.8.3-P1 <<>> @a.root-servers.net twitter.com +norecurse
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47005
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 14

;; QUESTION SECTION:
;twitter.com.           IN  A

;; AUTHORITY SECTION:
com.            172800  IN  NS  a.gtld-servers.net.
com.            172800  IN  NS  b.gtld-servers.net.
com.            172800  IN  NS  c.gtld-servers.net.
com.            172800  IN  NS  d.gtld-servers.net.
com.            172800  IN  NS  e.gtld-servers.net.
com.            172800  IN  NS  f.gtld-servers.net.
com.            172800  IN  NS  g.gtld-servers.net.
com.            172800  IN  NS  h.gtld-servers.net.
com.            172800  IN  NS  i.gtld-servers.net.
com.            172800  IN  NS  j.gtld-servers.net.
com.            172800  IN  NS  k.gtld-servers.net.
com.            172800  IN  NS  l.gtld-servers.net.
com.            172800  IN  NS  m.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net. 172800  IN  A   192.5.6.30
b.gtld-servers.net. 172800  IN  A   192.33.14.30
c.gtld-servers.net. 172800  IN  A   192.26.92.30
d.gtld-servers.net. 172800  IN  A   192.31.80.30
e.gtld-servers.net. 172800  IN  A   192.12.94.30
f.gtld-servers.net. 172800  IN  A   192.35.51.30
g.gtld-servers.net. 172800  IN  A   192.42.93.30
h.gtld-servers.net. 172800  IN  A   192.54.112.30
i.gtld-servers.net. 172800  IN  A   192.43.172.30
j.gtld-servers.net. 172800  IN  A   192.48.79.30
k.gtld-servers.net. 172800  IN  A   192.52.178.30
l.gtld-servers.net. 172800  IN  A   192.41.162.30
m.gtld-servers.net. 172800  IN  A   192.55.83.30
a.gtld-servers.net. 172800  IN  AAAA    2001:503:a83e::2:30

;; Query time: 31 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Thu Dec 29 08:32:23 2016
;; MSG SIZE  rcvd: 489
0

Just to dissolve the mystery.

In settings of my router I changed the DNS address from one big company's IP address to ISP's one and now it works, I am not sure what custom DNS server cause that behaviour, anyway the problem is solved.

5
  • 2
    That really does not dissolve any mystery, as it provides no reasonable explanation of how your router's proxy DNS server setting can affect the response traffic for the same query sent to the same IP address, 198.41.0.4.
    – JdeBP
    Dec 29, 2016 at 17:42
  • With my current level of knowledge I don't know either, just shared my findings.
    – Bulat M.
    Dec 29, 2016 at 18:07
  • 1
    In the comments to the original question you said that you changed provider, but now you say you are changing DNS address. Which is it? Using a different ISP enables me to come up with a coherent (but unusual) explanation, but just changing the dns server for a pretty much unrelated box shouldn't affect anything.
    – icarus
    Dec 29, 2016 at 20:30
  • 1
    This would likely point the weirdness towards the router itself but more tests would be needed to clarify it better. This type of behavior is often government controlled like in China.
    – Julie Pelletier
    Dec 30, 2016 at 3:47
  • @icarus. I connected via wifi phone's wifi and got usual expected behaviour. Then I changed dns of my first provider and it also solved the problem.
    – Bulat M.
    Dec 30, 2016 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .