2

Recently wondered how root server returns information about domains it doesn't have information about.

I thought that root dns server, for example, a.root-servers.net, doesn't perform recursive queries itself but instead returns referral - RR pointing to nameserver for TLD of the query.

I issued query about twitter.com hoping to get RR about nameservers for com. but got:

dig @a.root-servers.net twitter.com +norecurse

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @a.root-servers.net twitter.com +norecurse
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51937
;; flags: qr ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;twitter.com.           IN  A

;; ANSWER SECTION:
twitter.com.        748 IN  A   104.244.42.65
twitter.com.        748 IN  A   104.244.42.193

;; Query time: 27 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Thu Dec 29 17:54:09 MSK 2016
;; MSG SIZE  rcvd: 61

Could you explain why root server returns IP of Twitter, it seems that it should return referral only?

Correct me if I'm wrong. Thanks.

  • 2
    The big question is how can your machine produce that weird result. I confirmed (although I knew before running it), that I get the same output as DopeGhoti. – Julie Pelletier Dec 29 '16 at 15:41
  • 1
    The more I think about it, the more I'm convinced it can only be two things: either you are making a mistake we don't see or your connection is hijacked. Try ping a.root-servers.net to get its IP address. It gives me 198.41.0.4. Is it the same for you? – Julie Pelletier Dec 29 '16 at 15:45
  • 1
    I agree with @DopeGhoti, I can not replicate this. However we may be using different a.root-servers.net, see a.root-servers.org (org, not net) for some details. – icarus Dec 29 '16 at 15:47
  • 2
    In that case, there is a high probability that your port 53 (DNS query) is filtered and hijacked upstream (your local connection, ISP, or government). – Julie Pelletier Dec 29 '16 at 15:55
  • 1
    There are a number of things here. 1. Does it matter? It isn't part of any specification I know that the root nameservers can't return correct data. 2. Is the data correct? This is what en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions is all about. 3. Whilst everyone agrees that 198.41.0.4 is the IP address, this is a number of different machines around the world. Which one you connect to depends on your ISP and thier routing tables. Perhaps you need a VPN to effectively connect you to a different ISP. – icarus Dec 29 '16 at 16:28
4

Unable to replicate:

$ dig @a.root-servers.net twitter.com +norecurse

; <<>> DiG 9.8.3-P1 <<>> @a.root-servers.net twitter.com +norecurse
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47005
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 14

;; QUESTION SECTION:
;twitter.com.           IN  A

;; AUTHORITY SECTION:
com.            172800  IN  NS  a.gtld-servers.net.
com.            172800  IN  NS  b.gtld-servers.net.
com.            172800  IN  NS  c.gtld-servers.net.
com.            172800  IN  NS  d.gtld-servers.net.
com.            172800  IN  NS  e.gtld-servers.net.
com.            172800  IN  NS  f.gtld-servers.net.
com.            172800  IN  NS  g.gtld-servers.net.
com.            172800  IN  NS  h.gtld-servers.net.
com.            172800  IN  NS  i.gtld-servers.net.
com.            172800  IN  NS  j.gtld-servers.net.
com.            172800  IN  NS  k.gtld-servers.net.
com.            172800  IN  NS  l.gtld-servers.net.
com.            172800  IN  NS  m.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net. 172800  IN  A   192.5.6.30
b.gtld-servers.net. 172800  IN  A   192.33.14.30
c.gtld-servers.net. 172800  IN  A   192.26.92.30
d.gtld-servers.net. 172800  IN  A   192.31.80.30
e.gtld-servers.net. 172800  IN  A   192.12.94.30
f.gtld-servers.net. 172800  IN  A   192.35.51.30
g.gtld-servers.net. 172800  IN  A   192.42.93.30
h.gtld-servers.net. 172800  IN  A   192.54.112.30
i.gtld-servers.net. 172800  IN  A   192.43.172.30
j.gtld-servers.net. 172800  IN  A   192.48.79.30
k.gtld-servers.net. 172800  IN  A   192.52.178.30
l.gtld-servers.net. 172800  IN  A   192.41.162.30
m.gtld-servers.net. 172800  IN  A   192.55.83.30
a.gtld-servers.net. 172800  IN  AAAA    2001:503:a83e::2:30

;; Query time: 31 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Thu Dec 29 08:32:23 2016
;; MSG SIZE  rcvd: 489
0

Just to dissolve the mystery.

In settings of my router I changed the DNS address from one big company's IP address to ISP's one and now it works, I am not sure what custom DNS server cause that behaviour, anyway the problem is solved.

  • 2
    That really does not dissolve any mystery, as it provides no reasonable explanation of how your router's proxy DNS server setting can affect the response traffic for the same query sent to the same IP address, 198.41.0.4. – JdeBP Dec 29 '16 at 17:42
  • With my current level of knowledge I don't know either, just shared my findings. – Bulat M. Dec 29 '16 at 18:07
  • 1
    In the comments to the original question you said that you changed provider, but now you say you are changing DNS address. Which is it? Using a different ISP enables me to come up with a coherent (but unusual) explanation, but just changing the dns server for a pretty much unrelated box shouldn't affect anything. – icarus Dec 29 '16 at 20:30
  • 1
    This would likely point the weirdness towards the router itself but more tests would be needed to clarify it better. This type of behavior is often government controlled like in China. – Julie Pelletier Dec 30 '16 at 3:47
  • @icarus. I connected via wifi phone's wifi and got usual expected behaviour. Then I changed dns of my first provider and it also solved the problem. – Bulat M. Dec 30 '16 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.