[dns-operations] Accurately identifying glue records

[John Kristoff]

On Mon, 15 May 2006 23:35:15 +0200
Roy Arends <roy at dnss.ec> wrote:

> So, glue-report takes a name, say oarci.net, finds the parent zone  
> and shows the delegation material and glue (if exists).

That's the basic idea:

  $ echo oarci.net | ./glue-report 
  oarci.net|parent=192.42.93.30|ns=ns-ext.isc.org.|ns=ns-ext.lga1.isc.org.|ns=ns-ext.nrt1.isc.org.|ns=ns-ext.sth1.isc.org.

That parent is just one of whichever Net::DNS happens to pick from the
referral it got from the root.  If there was any glue, you might see
something like this:

  $ echo iana.org | ./glue-report 
  iana.org|parent=199.7.66.1|ns=sec3.apnic.net.|ns=sec1.apnic.net.|ns=rip.psg.com.|ns=ns.icann.org. +glue 192.0.34.126|ns=c.iana-servers.net.|ns=b.iana-servers.org.|ns=a.iana-servers.net.

And if any parent returns an answer with the ra bit set you see
something like this:

  echo gov.ar | ./glue-report
  gov.ar|parent=200.10.202.3|ns=ns.uu.net.|ns=ns1.retina.ar. +glue [ra] 200.10.202.3|ns=athea.ar. +glue [ra] 200.16.98.2|ns=ctina.ar. +glue [ra] 200.16.97.17|ns=merapi.switch.ch.|ns=relay1.mecon.gov.ar.

> Does it judge the 'properness' of glue or the non-existence of it?  
> (not that it needs to, just curious).

It doesn't judge, it just reports if there is any glue or not.
Really the only additional thing I did was to indicate if the ra bit
was set to act as a warning that glue may be not really be there.

> Note that the AA bit is only valid for the answer and authority  
> sections. Not for the additional section.
> Does it really matter where the glue in the additional section comes  
> from ? Even when its through cached material instead of glue
> included in the zone. As long as the glue is in-bailiwick, the
> resolver can't tell.

I check for glue by sending a direct, non-recursive A query to the
parent for each of the RRs in the NS RRSet it previously got from
that parent.

John