<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 8, 2021 at 6:03 AM Mark Delany <<a href="mailto:b9w@charlie.emu.st">b9w@charlie.emu.st</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 07Jun21, Giovane C. M. Moura via dns-operations allegedly wrote:<br>
<br>
> FWIW, we did a study a couple of years ago [1] analyzing these<br>
> inconsistencies. We found 13 million second-level domains (out of 166M)<br>
> that were inconsistent [0] (table 1, data from 2019-10-16)<br>
<br>
Asking for a friend. Did you use a tool that is generally available to the average Joe<br>
such that they can test their own domains?<br>
<br>
The most common DNS support questions I get from small-time dns admins invariably revolve<br>
around discrepancies between delegation, name servers and hidden masters.<br></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">Related to this, does anyone have a list of good web based "DNS checkers"? I *feel* like there used to be a number of good tools, but I managed to throw away that set of bookmarks. There are still many "test your recursive servers <here>" pages, but I'm looking for something that tests authoratives, and walks all possible paths, checks for v4 and v6, MTU, etc.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">At the moment the main site that I'm recommending for this is IIS.SEs Zonemaster - <a href="https://zonemaster.iis.se/">https://zonemaster.iis.se/</a> and DNSViz.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Zonemaster is really close, but I'd like a few other options as well.<br></div><div class="gmail_default" style="font-family:verdana,sans-serif">DNSViz is, of course, excellent for DNSSEC debugging, but it can be fairly confusing to less experienced people trying to debug non-DNSSEC issues.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">So, what are people's favorite tools, especially those that you can just point a user at?</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">W</div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
I use a home-grown command-line tool which sorta, kinda works, but it's rough. For<br>
example, here's what it says about <a href="http://apple.com" rel="noreferrer" target="_blank">apple.com</a>:<br>
<br>
<a href="http://apple.com" rel="noreferrer" target="_blank">apple.com</a>. Errors: 12<br>
IP a.ns.apple.com./2620:149:ae0::53 in Name Server:c.ns.apple.com./<a href="http://204.19.119.1" rel="noreferrer" target="_blank">204.19.119.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP b.ns.apple.com./2620:149:ae7::53 in Name Server:c.ns.apple.com./<a href="http://204.19.119.1" rel="noreferrer" target="_blank">204.19.119.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP a.ns.apple.com./2620:149:ae0::53 in Name Server:d.ns.apple.com./<a href="http://204.26.57.1" rel="noreferrer" target="_blank">204.26.57.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP b.ns.apple.com./2620:149:ae7::53 in Name Server:d.ns.apple.com./<a href="http://204.26.57.1" rel="noreferrer" target="_blank">204.26.57.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP a.ns.apple.com./2620:149:ae0::53 in Name Server:c.ns.apple.com./2620:171:800:714::1 but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP b.ns.apple.com./2620:149:ae7::53 in Name Server:c.ns.apple.com./2620:171:800:714::1 but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP a.ns.apple.com./2620:149:ae0::53 in Name Server:d.ns.apple.com./2620:171:801:714::1 but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP b.ns.apple.com./2620:149:ae7::53 in Name Server:d.ns.apple.com./2620:171:801:714::1 but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP b.ns.apple.com./2620:149:ae7::53 in Name Server:b.ns.apple.com./<a href="http://17.253.207.1" rel="noreferrer" target="_blank">17.253.207.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP a.ns.apple.com./2620:149:ae0::53 in Name Server:b.ns.apple.com./<a href="http://17.253.207.1" rel="noreferrer" target="_blank">17.253.207.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP b.ns.apple.com./2620:149:ae7::53 in Name Server:a.ns.apple.com./<a href="http://17.253.200.1" rel="noreferrer" target="_blank">17.253.200.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
IP a.ns.apple.com./2620:149:ae0::53 in Name Server:a.ns.apple.com./<a href="http://17.253.200.1" rel="noreferrer" target="_blank">17.253.200.1</a> but not in delegation ;; AUTHORITY/a.gtld-servers.net./<a href="http://192.5.6.30" rel="noreferrer" target="_blank">192.5.6.30</a><br>
<br>
Which is a lot of verbosity to say the glue from <a href="http://a.gtld-servers.net" rel="noreferrer" target="_blank">a.gtld-servers.net</a> (and presumably all<br>
other GTLD servers) lacks the ipv6 addresses for <a href="http://a.ns.apple.com" rel="noreferrer" target="_blank">a.ns.apple.com</a> and <a href="http://b.ns.apple.com" rel="noreferrer" target="_blank">b.ns.apple.com</a> yet<br>
they're present in the in-bailiwick name servers.<br>
<br>
This of course is a minor matter rather than a fault, but it does mean that the ipv6 name<br>
servers will get a vastly reduced set of queries compared to all other name servers. To my<br>
mind this is indicative of an oversight on the domain admin's front.<br>
<br>
I'll really like to upgrade to a clearer command-line tool which can be incorporated into<br>
a zone update work-flow so that my friends can immediately know when they have messed<br>
up.<br>
<br>
Does such a beast exist?<br>
<br>
<br>
Mark.<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">The computing scientist’s main challenge is not to get confused by the<br>complexities of his own making. <br> -- E. W. Dijkstra</div></div></div>