<div dir="ltr"><div><div><br></div><div><div>dig @<a href="http://n.de.net">n.de.net</a> <a href="http://1s.de">1s.de</a> mx +dnssec</div><div>and find that the mx record of <a href="http://1s.de">1s.de</a> is from the <a href="http://n.de.net">n.de.net</a>(194.146.107.6), but it is not enough to make sure that from the .de zone. Maybe it the nameservers for the .de zone also serve for the <a href="http://1s.de">1s.de</a>.</div>
</div><div><br></div><div>so it is clear for .de administrator to know the details.</div><div><br></div><div>2014-03-28 10:34 GMT+08:00 Paul Wouters <span dir="ltr"><<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>></span>:<br>
</div></div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="">On Thu, 27 Mar 2014, Paul Vixie wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Those and the others you quoted are all glue records, not authoritative,<br>
and no RRSIG's over those records.<br>
</blockquote>
<br>
here's how i checked my work.<br>
</blockquote>
<br></div>
I don't see how that checks your work?<div class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +trace <a href="http://1s.de" target="_blank">1s.de</a> mx<br>
;; global options: +cmd<br>
. 15714 IN NS <a href="http://a.root-servers.net" target="_blank">a.root-servers.net</a>.<br>
</blockquote></div>
[...]<div class=""><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 429 ms<br>
</blockquote>
<br></div>
How did google DNS get into this picture?<br></blockquote><div><br></div><div>I am not clear about what does the matter with GOOGLE DNS.</div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
I do get an RRSIG for the mx of <a href="http://1s.de" target="_blank">1s.de</a>, despite a lack of NS records.<br>
But you wrote:<br>
<br>
i> vixie@linux1:~/work/fsi/dnsdb_<u></u>c$ ./dnsdb_query -r \*.de/a/de -l 5<div class=""><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
;; record times: 2010-07-15 00:37:59 .. 2011-10-27 21:35:17<br>
;; count: 291; bailiwick: de.<br>
<a href="http://4.de" target="_blank">4.de</a>. A 212.227.111.250<br>
<br>
;; record times: 2011-01-12 11:00:47 .. 2011-01-25 13:46:42<br>
;; count: 25; bailiwick: de.<br>
<a href="http://e.de" target="_blank">e.de</a>. A 81.91.170.47<br>
</blockquote>
<br></div>
And I only see glue for those:<br>
<br>
paul@bofh:~$ dig +dnssec a <a href="http://4.de" target="_blank">4.de</a>. @<a href="http://l.de.net" target="_blank">l.de.net</a>.<br>
<br>
; <<>> DiG 9.9.3-rl.13207.22-P2-RedHat-9.<u></u>9.3-14.P2.fc19 <<>> +dnssec a<br>
<a href="http://4.de" target="_blank">4.de</a>. @<a href="http://l.de.net" target="_blank">l.de.net</a>.<div class=""><br>
;; global options: +cmd<br>
;; Got answer:<br></div>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29167<br>
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1<div class=""><br>
;; WARNING: recursion requested but not available<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags: do; udp: 4096<br>
;; QUESTION SECTION:<br></div>
;<a href="http://4.de" target="_blank">4.de</a>. IN A<br>
<br>
;; AUTHORITY SECTION:<br>
<a href="http://4.de" target="_blank">4.de</a>. 86400 IN NS <a href="http://ns1.sedoparking.com" target="_blank">ns1.sedoparking.com</a>.<br>
<a href="http://4.de" target="_blank">4.de</a>. 86400 IN NS <a href="http://ns2.sedoparking.com" target="_blank">ns2.sedoparking.com</a>.<br>
H319DM5GC3EDEK691VQBHEHOT7VGGJ<u></u>2B.de. 7200 IN NSEC3 1 1 15 BA5EBA11<br>
H31BJ3G4QCC5ICBKQH14CB2K8KTQIC<u></u>PL NS SOA RRSIG DNSKEY NSEC3PARAM<br>
H319DM5GC3EDEK691VQBHEHOT7VGGJ<u></u>2B.de. 7200 IN RRSIG NSEC3 8 2 7200<br>
20140403230000 20140327230000 53878 de.<br>
ZtJ+KUJTnh9QSOedPs+<u></u>4nIuLbkxa86JbsRplMFtRhfbq9KWMM<u></u>p+YHzgr<br>
UFKiQ71d9QBDyGoCov1+<u></u>Oz3EgfGSkojB71jgOTWDRB5LYdXO35<u></u>ACFDa2<br>
HeA/<u></u>0cTMjT7Ul52n40oGw8zP6PmUp9A1S/<u></u>h2uVRw8BMCFNwe/HHT8fPC 1Us=<br>
OFECAIH12QR28GUSVDT6U10ITI4BPE<u></u>D0.de. 7200 IN NSEC3 1 1 15 BA5EBA11<br>
OFEM3DBGPQNQ64PA9KGQTN4DR1O4CH<u></u>58 OFECAIH12QR28GUSVDT6U10ITI4BPE<u></u>D0.de. 7200 IN RRSIG NSEC3 8 2 7200<br>
20140403230000 20140327230000 53878 de.<br>
A3VN8HixeQ/H556rrOpWAbGO9bm5+<u></u>Jv6EFw/PJBRCnZwRlIYuTaI+Se2<br>
vWSNT2iImyDNln5XIIOZz3/<u></u>vK1nlld3LxmX78Wz+455OX2U/<u></u>wLcK0pFv<br>
s0E64Lf/<u></u>PAWfkU8NhGXdBQoMol8ZcW0/<u></u>xqfdZurDhQlM5g74IwTiiA1z fEw=<br>
<br>
;; Query time: 95 msec<br>
;; SERVER: 77.67.63.105#53(77.67.63.105)<br>
;; WHEN: Thu Mar 27 22:32:39 EDT 2014<br>
;; MSG SIZE rcvd: 567<br>
<br>
paul@bofh:~$</blockquote><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">
<div class="h5">
______________________________<u></u>_________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.<u></u>net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/<u></u>mailman/listinfo/dns-<u></u>operations</a><br>
dns-jobs mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/<u></u>mailman/listinfo/dns-jobs</a><br>
</div></div></blockquote></div><br></div></div>