<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font size="+1">Ok, so we had a registrant with the following:</font></p>
<p><font size="+1">luckyconnect.co.za</font></p>
<p><font size="+1"> NS ns3.rsa-tel.co.za</font></p>
<p><font size="+1"> NS ns4.rsa-tel.co.za</font></p>
<p><font size="+1">and</font></p>
<p><br>
<font size="+1"><font size="+1">rsa-tel.co.za</font></font></p>
<p><font size="+1"><font size="+1"> NS ns1.luckyconnect.co.za</font></font></p>
<p><font size="+1"><font size="+1"> NS ns2.luckyconnect.co.za</font></font></p>
<p><font size="+1"><font size="+1"><br>
</font></font></p>
<p><font size="+1"><font size="+1">Classic glueless recursive
mess-up.<br>
</font></font></p>
<p><font size="+1"><font size="+1"><br>
</font></font></p>
<p><font size="+1"><font size="+1">I was seeing notable traffic on
co.za Auth's from <br>
</font></font></p>
<p>172.253.*</p>
<p>74.125.*<br>
</p>
<p>and</p>
<p>2a00:1450:400a:*</p>
<p>2800:3f0:4003:*<br>
</p>
<p>trying to resolve the above two zones.<br>
</p>
<p><br>
</p>
<p>I'm assuming they're related to 8.8.8.8?</p>
<p><br>
</p>
<p>once the registrant updated the NS's for one zone, breaking the
glueless recursion, it went away.</p>
<p><br>
</p>
<p>(and yeah - maybe I'm throwing away another bug bounty).</p>
<p><br>
</p>
<p>regards</p>
<p><br>
</p>
<p>--Calvin Browne<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 15/04/2020 16:33, Dave Lawrence
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:24215.6966.394479.612869@gro.dd.org">
<pre class="moz-quote-pre" wrap="">Calvin Browne writes:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">does anyone here know how 8.8.8.8 handles recursive glueless situations?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
The Google folks are on the list and undoubtedly will answer, but I'm
still curious about what even prompts the question.
If it's actually missing glue -- NS records that are under the
delegation point -- and the delegating NS RRset does not include any
independent NSs, then the protocol itself doesn't have an intrinsic
mechanism for forward progress. A resolver should SERVFAIL its
client, perhaps with the "Code 22 - No Reachable Authority" extended
error code.
Are you seeing something that suggests Google DNS is making some
additional effort to continue?
</pre>
</blockquote>
</body>
</html>