[dns-operations] Non-working glue for DNAME expanded xn--mgba3a4f16a (Iran IDNA)

[Viktor Dukhovni]

The xn--mgba3a4f16a TLD (IDNA for Iran) is one of only two TLDs
with a zone apex DNAME record:

    xn--mgba3a4f16a. IN DNAME xn--mgba3a4f16a.ir.
    xn--kprw13d.     IN DNAME xn--kpry57d.

Today, name resolution under xn--mgba3a4f16a (aka xn--mgba3a4f16a.ir)
is not working too well:

    $ dig +norecur +noidn +noall +ans +auth +nocl +nottl -t ns xn--mgba3a4f16a.ir. @b.nic.ir.
    xn--mgba3a4f16a.ir.     NS      a.nic.ir.
    xn--mgba3a4f16a.ir.     NS      b.nic.ir.
    xn--mgba3a4f16a.ir.     NS      ir.cctld.authdns.ripe.net.

    $ dig +norecur +noidn +noall +comment +ans +auth +nocl +nottl -t ns xn--mgba3a4f16a.ir. @a.nic.ir.
    ;; connection timed out; no servers could be reached

    $ dig +norecur +noidn +noall +ans +auth +nocl +nottl -t ns xn--mgba3a4f16a.ir. @ir.cctld.authdns.ripe.net.
    xn--mgba3a4f16a.ir.     NS      a.irnic.ir.
    xn--mgba3a4f16a.ir.     NS      b.irnic.ir.
    xn--mgba3a4f16a.ir.     NS      ns2.cuhk.edu.hk.

I'm having trouble reaching the "a.nic.ir" server, and none of the
nameservers returned by ripe.net serve the zone:

    $ dig +norecur +noidn +noall +comment +ans +auth +nocl +nottl -t ns xn--mgba3a4f16a.ir. @ns2.cuhk.edu.hk.
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 13914
    ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

    $ dig +norecur +noidn +noall +comment +ans +auth +nocl +nottl -t ns xn--mgba3a4f16a.ir. @b.irnic.ir.
    ;; connection timed out; no servers could be reached

    $ dig +norecur +noidn +noall +comment +ans +auth +nocl +nottl -t ns xn--mgba3a4f16a.ir. @a.irnic.ir.
    ;; connection timed out; no servers could be reached

-- 
	Viktor.