<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Someone was asking me to help debug a problem with their domain, but
this in turn showed that there are a bunch of problems with the .BD
top level domain itself. Hopefully there is someone on this list who
can look at them.<br>
<br>
Firstly, here is the delegation at the root.<br>
<br>
$ dig +norec @a.root-servers.net. bd. ns<br>
...<br>
;; AUTHORITY SECTION:<br>
bd. 172800 IN NS jamuna.btcl.net.bd.<br>
bd. 172800 IN NS surma.btcl.net.bd.<br>
bd. 172800 IN NS dns.bd.<br>
<br>
;; ADDITIONAL SECTION:<br>
jamuna.btcl.net.bd. 172800 IN A 203.112.194.231<br>
surma.btcl.net.bd. 172800 IN A 203.112.194.232<br>
<b>dns.bd. 172800 IN A 209.58.24.3</b><b><br>
</b><br>
<br>
Now here is the information when you query one of these servers:<br>
<br>
$ dig @209.58.24.3 bd. ns<br>
...<br>
;; ANSWER SECTION:<br>
bd. 86400 IN NS dns2.bd.<br>
bd. 86400 IN NS bd-ns.anycast.pch.net.<br>
bd. 86400 IN NS surma.btcl.net.bd.<br>
bd. 86400 IN NS jamuna.btcl.net.bd.<br>
bd. 86400 IN NS dns.bd.<br>
<br>
;; ADDITIONAL SECTION:<br>
<b>dns.bd. 86400 IN A 203.112.194.242</b><b><br>
</b><b>dns.bd. 86400 IN AAAA 2407:5000:88:5::3</b><b><br>
</b>dns2.bd. 86400 IN A 123.49.12.161<br>
<br>
Problem 1: the IP address of dns.bd within the zone is different to
the IP address of dns.bd in the glue records.<br>
<br>
Problem 2: dns.bd does not respond on the IP address which is listed
within the zone<br>
<br>
$ dig +norec <b>@203.112.194.242</b> bd. ns<br>
<br>
; <<>> DiG 9.8.3-P1 <<>> +norec
@203.112.194.242 bd. ns<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, <b>status: </b><b>REFUSED</b>,
id: 18221<br>
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br>
<br>
Problem 3: although dns.bd *does* respond on the IPv6 address
2407:5000:88:5::3, there is no glue for this in the root.<br>
<br>
Problem 4: the bd zone lists two additional nameservers (dns2.bd and
bd-ns.anycast.pch.net) which are not listed in the root<br>
<br>
Problem 5: dns2.bd (on address 123.49.12.161) does not respond to
queries<br>
<br>
$ dig @123.49.12.161 dns2.bd. a<br>
<br>
; <<>> DiG 9.8.3-P1 <<>> @123.49.12.161
dns2.bd. a<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; connection timed out; no servers could be reached<br>
<br>
Since the data *inside* the zone is authoritative, and takes
precedence over what is in the delegation from outside, this means
that once someone has done a query for BD. they will (a) learn the
wrong IP address for dns.bd, and (b) learn about dns2.bd which
doesn't work at all - this will slow down queries for any .bd names
going forward.<br>
<br>
I tried some online DNS checkers and they didn't seem to be able to
spot these problems. Doing it the old-fashioned manual way is still
necessary it seems :-(<br>
<br>
The way DNS fails over, things will still work more or less. But if
you can make the delegation consistent with the content of the zone,
things will work more reliably.<br>
<br>
Regards,<br>
<br>
Brian Candler.<br>
</body>
</html>