Need to understand how 2003 DNS server root hints work
Hello Experts,
I've got a problem resolving a particular external Internet address on all the (internal domain) DNS servers in one of my domains.
I do not use forwarders, only root hints (no forwarders). We switched ISPs about 2 weeks ago and have had this problem since.
I've configured several DNS servers like this, and slogged me way many other problems, but I've never had an issue with the root hints - so I've never really learned how they work in any detail.
I know they are well known established servers that somehow, mysteriously help DNS find a NS authoritative for whatever address you are trying to resolve. I think this has something to do with breaking down the address (i.e. www.yahoo.com to www and yahoo and com). That is about the extent of what I know.
I've examined debug logs on DNS servers from the effected domain and a domain that CAN resolve the address. What I can't figure out is what is wrong, because I don't really understand how root hints work in detail.
Now that I've said a mouthful, I'm looking for a good place online where I can find out some detail so I can figure out these debug logs.
Anyone have good recommendation(s) on a site with details on how root hints work?
Thanks in advance!!!
I've got a problem resolving a particular external Internet address on all the (internal domain) DNS servers in one of my domains.
I do not use forwarders, only root hints (no forwarders). We switched ISPs about 2 weeks ago and have had this problem since.
I've configured several DNS servers like this, and slogged me way many other problems, but I've never had an issue with the root hints - so I've never really learned how they work in any detail.
I know they are well known established servers that somehow, mysteriously help DNS find a NS authoritative for whatever address you are trying to resolve. I think this has something to do with breaking down the address (i.e. www.yahoo.com to www and yahoo and com). That is about the extent of what I know.
I've examined debug logs on DNS servers from the effected domain and a domain that CAN resolve the address. What I can't figure out is what is wrong, because I don't really understand how root hints work in detail.
Now that I've said a mouthful, I'm looking for a good place online where I can find out some detail so I can figure out these debug logs.
Anyone have good recommendation(s) on a site with details on how root hints work?
Thanks in advance!!!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
being designated as a lame server should not affect lookup requests. I do not support using windoes DNS without forwarders. Resolution via root hints is slow. You have to make 4 or more calls to resolve anything and each call has the latency of your copper last mile each way.
Most name servers will shut off all requests from a lame server, for time periods starting around 1 hour. There are other things that are done when name servers either don't answer, have conflicting answers, and so forth. The idea is to simply stop routing bad information until someone with DNS knowledge fixes it in order to stop it and perhaps thousands or millions of other irresponsible name servers from clotting requests with repeated erroneous data and responses.
They do affect lookups, if you keep going to the same ones without the option of alternate routes. With a lot of corporate traffic, which doesn't trust everyone, they are getting more and more lags as they search for trusted name servers. It takes a lot longer to track down things like loops, where name servers in a given order point back to an endless loop. Eventually, they'll time out and the request will timeout as its time to live is exceeded.
Routes resolved sans root servers is unreliable. How do you get to .com and .net roots if you don't ask the root servers? And can you trust the answers? Both answers are "unreliable."
Firewalls and stealthing have basically added timeouts to every domain that doesn't answer a DNS query. That may be a big part of the problem. The first name server you hit, usually the one at your ISP, already knows the roots and so doesn't have to look them up at all. If you're traces show you hitting the root server, and you're not a registry name server, then you are simply misconfigured. It's not the fault of the root servers if you're a regstry name server, or configured as such, it's your DNS configuration that is wrong.
Perhaps the problem is that you shouldn't be querying the root servers in the first place; a very likely event if you're banging away at servers that are only going to tell you "go back to your name server that is delegated to handle your requests."
You should only need the root servers once, to initialize your DNS database to find out where your name servers are, the upstream ones that are delegated to answer your requests. It makes sense that if you switched ISP's, then you are having a problem with your assigned name servers from your ISP, or, you have the old ISP name servers somewhere, or, they have not deleted the old records that pointed to your domain.
Here's a typical example: we switched IP Address Blocks more than a month ago, yet, the old Reverse Record is still there, check if you care, do a reverse record lookup for 68.162.85.5 result is Musics.com but if you do a Reverse Record lookup for 71.242.125.59 you'll also get Musics.com
The effect? Well, it's possible for someone to get the wrong pointer and perhaps get a timeout, although we maintain a server on that IP Address pending record deletion. You might want to check the Reverse Records for your domain as well. It's also possible that your getting conflicting updates, which is what would happen to us if we didn't write our own records for two other domains in an attempt to eliminate the upstream name servers and rely solely on our own and the root servers. This requires some major changes in the way we do DNS, it's not so simple as "you just plug in your own name servers," it doesn't work that way because at least one name server must be a registry name server. That requires applications to IANA, and some other rules, such as all Registrars must see the new name server as a registry name server, or they will not accept it as a domain name server.
It also costs lots of money, at least a payment of $2,500.00 to IANA because they consider the territory to be that of an ISP and you must register as an ISP.
IANA has about a million such stupid rules and regulations that stop domain owners from doing business; these should be corrected by law because IANA is not going to change until ordered to do so, they're too obstinate about their "precious." They should also be stopped because they violate anti trust laws, the ones that say you can't control a business by means which effectively stop or delay that business in its pursuit of success. Two things at IANA do this, 01.) the monopoly of who can get a registry name server, and 02.) the monopoly of who can get an IP Address block. These effectively put all the gold coins in the hands of a few corporations, completely cut off all third world and undeveloped countries and their businesses from quick success, if any success at all, and institute a system of controlling the assignment of IP4 and IPv6 blocks based on economic scale. This retards the growth of all other businesses save the Fortune 10 who provide the root servers, if you must know the truth of what purpose the root servers really serve.
For now, unless you can afford IANA's fees, and live up to their requirement that you use a full /22 prefix block, and prove it every month, else it will be confiscated back from you, you have to pay your ISP for IP Address Block space and you have to use their name servers. Whatever load they are experiencing will affect just how fast you get results. You see? The current system is broken and there is no incentive for them to fix it, they're making too much money from it and controlling business and economies world wide.
Which is why IANA, IEEE, and the IETF [all the same people, from the top ten American (sic!) corporations], are so obstinate; they're all making lots of money by holding IP Addresses "hostage."
Which only, as carl_legere has said, slows the entire Internet down.
Maybe France will nationalize the root servers in France and make IP Address blocks available to all Frenchmen, free of charge, and maybe this will force the hardheads to change, as each country in turn does the same until only America is the one charging for IP Addresses, at which point, no one but Americans will care, and will perhaps finally do something about this "tax on numbers," this corporate welfare system that keeps them all in undeserved income at the expense of the rest of us.
I will suggest further what I always suggest; get either Ethereal or use Network Monitor and see on a packet per packet basis what is slowing things down and causing breaks in fetches and queries. Sometimes the logs are just not enough.
They do affect lookups, if you keep going to the same ones without the option of alternate routes. With a lot of corporate traffic, which doesn't trust everyone, they are getting more and more lags as they search for trusted name servers. It takes a lot longer to track down things like loops, where name servers in a given order point back to an endless loop. Eventually, they'll time out and the request will timeout as its time to live is exceeded.
Routes resolved sans root servers is unreliable. How do you get to .com and .net roots if you don't ask the root servers? And can you trust the answers? Both answers are "unreliable."
Firewalls and stealthing have basically added timeouts to every domain that doesn't answer a DNS query. That may be a big part of the problem. The first name server you hit, usually the one at your ISP, already knows the roots and so doesn't have to look them up at all. If you're traces show you hitting the root server, and you're not a registry name server, then you are simply misconfigured. It's not the fault of the root servers if you're a regstry name server, or configured as such, it's your DNS configuration that is wrong.
Perhaps the problem is that you shouldn't be querying the root servers in the first place; a very likely event if you're banging away at servers that are only going to tell you "go back to your name server that is delegated to handle your requests."
You should only need the root servers once, to initialize your DNS database to find out where your name servers are, the upstream ones that are delegated to answer your requests. It makes sense that if you switched ISP's, then you are having a problem with your assigned name servers from your ISP, or, you have the old ISP name servers somewhere, or, they have not deleted the old records that pointed to your domain.
Here's a typical example: we switched IP Address Blocks more than a month ago, yet, the old Reverse Record is still there, check if you care, do a reverse record lookup for 68.162.85.5 result is Musics.com but if you do a Reverse Record lookup for 71.242.125.59 you'll also get Musics.com
The effect? Well, it's possible for someone to get the wrong pointer and perhaps get a timeout, although we maintain a server on that IP Address pending record deletion. You might want to check the Reverse Records for your domain as well. It's also possible that your getting conflicting updates, which is what would happen to us if we didn't write our own records for two other domains in an attempt to eliminate the upstream name servers and rely solely on our own and the root servers. This requires some major changes in the way we do DNS, it's not so simple as "you just plug in your own name servers," it doesn't work that way because at least one name server must be a registry name server. That requires applications to IANA, and some other rules, such as all Registrars must see the new name server as a registry name server, or they will not accept it as a domain name server.
It also costs lots of money, at least a payment of $2,500.00 to IANA because they consider the territory to be that of an ISP and you must register as an ISP.
IANA has about a million such stupid rules and regulations that stop domain owners from doing business; these should be corrected by law because IANA is not going to change until ordered to do so, they're too obstinate about their "precious." They should also be stopped because they violate anti trust laws, the ones that say you can't control a business by means which effectively stop or delay that business in its pursuit of success. Two things at IANA do this, 01.) the monopoly of who can get a registry name server, and 02.) the monopoly of who can get an IP Address block. These effectively put all the gold coins in the hands of a few corporations, completely cut off all third world and undeveloped countries and their businesses from quick success, if any success at all, and institute a system of controlling the assignment of IP4 and IPv6 blocks based on economic scale. This retards the growth of all other businesses save the Fortune 10 who provide the root servers, if you must know the truth of what purpose the root servers really serve.
For now, unless you can afford IANA's fees, and live up to their requirement that you use a full /22 prefix block, and prove it every month, else it will be confiscated back from you, you have to pay your ISP for IP Address Block space and you have to use their name servers. Whatever load they are experiencing will affect just how fast you get results. You see? The current system is broken and there is no incentive for them to fix it, they're making too much money from it and controlling business and economies world wide.
Which is why IANA, IEEE, and the IETF [all the same people, from the top ten American (sic!) corporations], are so obstinate; they're all making lots of money by holding IP Addresses "hostage."
Which only, as carl_legere has said, slows the entire Internet down.
Maybe France will nationalize the root servers in France and make IP Address blocks available to all Frenchmen, free of charge, and maybe this will force the hardheads to change, as each country in turn does the same until only America is the one charging for IP Addresses, at which point, no one but Americans will care, and will perhaps finally do something about this "tax on numbers," this corporate welfare system that keeps them all in undeserved income at the expense of the rest of us.
I will suggest further what I always suggest; get either Ethereal or use Network Monitor and see on a packet per packet basis what is slowing things down and causing breaks in fetches and queries. Sometimes the logs are just not enough.
in my post I was referring strictly to DNS as it pertains to being a recursive lookup database, NOT DNS for maintaining authoritative records on your side.
The question, as written appears to be reguarding DNS recursion and not DNS authoritative.
The question, as written appears to be reguarding DNS recursion and not DNS authoritative.
>>The American People invented it and the computer, paid for both with their tax dollars, and because of that, and by U.S. Law, it belongs to them as the aboriginal Author. <<
Aside form the rest of the ra-ra claptrap, the use of "aboriginal Author" was amusing to say the least.
Aside form the rest of the ra-ra claptrap, the use of "aboriginal Author" was amusing to say the least.
Fortunately DNS root servers are now distributed so if the Germans (who invented the first programmable computer) turned off their k.root-servers.net in Frankfurt and the British (who invented the first electronic computer) turned off their k-root-servers.net in London the French (who invented the punched card system) could still resolve ccTLD and gTLD queries from the k-root-servers.net in Amsterdam.
lol
dont forget poland, they were in the coalition of the willing
dont forget poland, they were in the coalition of the willing
The Poles have one in Poznan; www.root-servers.org.
>>dont forget poland, they were in the coalition of the willing<<
Also Honduras.
Also Honduras.
I thought Al Gore invented the interweb!
no No NO! al gore said he CREATED the internet, not invented it
yeah, yeah, yeah, and a German, Albert Einstein, invented the atomic bomb.
J. Presper Eckert and John Mauchly invented the first computer. Period.
Any other statement is one of those old U.S.S.R. statement about how they invented everything, with a dyslexic language, no less.
Personally, if Germany and France turned off their root servers, no one would even notice.
C'est la vie, c'est la guerre.
J. Presper Eckert and John Mauchly invented the first computer. Period.
Any other statement is one of those old U.S.S.R. statement about how they invented everything, with a dyslexic language, no less.
Personally, if Germany and France turned off their root servers, no one would even notice.
C'est la vie, c'est la guerre.
"J. Presper Eckert and John Mauchly invented the first computer. "
Actually a Brit came up with the idea
http://www.fourmilab.ch/babbage/contents.html
and a German invented it first
http://www.epemag.com/zuse/
"yeah, yeah, yeah, and a German, Albert Einstein, invented the atomic bomb."
Einstein's work on the bomb consisted of 2 days work and the signing of a letter to Roosevelt.
The "inventor" of the bomb was a team of people led by Oppenheimer and Teller.
"Any other statement is one of those old U.S.S.R. statement about how they invented everything, with a dyslexic language, no less."
ya...no sense in having some actual facts to back up your point. And add a slur in for good measure.
"The General Internet License [GIL], is a mostly free license granted by the U.S. to the rest of the world to freely use the Internet. The Internet is owned and Copyrighted by those who own it, the People of the United States of America, and no one else."
google for "general internet license" you'll get one hit...(out of 25,270,000,000 indexed pages)
https://www.experts-exchange.com/questions/21881951/Need-to-understand-how-2003-DNS-server-root-hints-work.html
say...you didn't invent the GIL didya?
Actually a Brit came up with the idea
http://www.fourmilab.ch/babbage/contents.html
and a German invented it first
http://www.epemag.com/zuse/
"yeah, yeah, yeah, and a German, Albert Einstein, invented the atomic bomb."
Einstein's work on the bomb consisted of 2 days work and the signing of a letter to Roosevelt.
The "inventor" of the bomb was a team of people led by Oppenheimer and Teller.
"Any other statement is one of those old U.S.S.R. statement about how they invented everything, with a dyslexic language, no less."
ya...no sense in having some actual facts to back up your point. And add a slur in for good measure.
"The General Internet License [GIL], is a mostly free license granted by the U.S. to the rest of the world to freely use the Internet. The Internet is owned and Copyrighted by those who own it, the People of the United States of America, and no one else."
google for "general internet license" you'll get one hit...(out of 25,270,000,000 indexed pages)
https://www.experts-exchange.com/questions/21881951/Need-to-understand-how-2003-DNS-server-root-hints-work.html
say...you didn't invent the GIL didya?
The first computer was invented by J. Presper Eckert and John Mauchly at the University of Pensylvania, in Philadelphia, Pennsylvania in 1946. The United States of America was founded in Philadelphia, Pennsylvania in 1776.
If you can't admit the truth, then join the communist party, where such denials of history belong.
The Russian language and alphabet is dyslexic, you're trolling now, by twisting accepted truths.
The Internet was invented in America.
Why is it that even when America gives people a gift, they have to insist that we're only returning something they lost? Sounds like sheer jealousy and envy to me.
Stop lying about who invented the computer and the Internet and just accept it. No one keeps company or respects liars. Suse and Turing may as well be put in with the French loom as far as having invented a computer, which predates them by a few hundred years and was programmable.
None of the Suse, Turing, or Frenchie ideas though were computers.
Such jealousy.
It's actually an insult, to us, to the University, and to the city where America became Ameri ca. Why don't you try and enforce your theory of Internet copyrights with the United States Armed Forces; I'd like to see how far that gets these obviously false ideas about who invented what and who created what.
And if you can't say "Thanks" to America, then return the gift and just leave.
If you can't admit the truth, then join the communist party, where such denials of history belong.
The Russian language and alphabet is dyslexic, you're trolling now, by twisting accepted truths.
The Internet was invented in America.
Why is it that even when America gives people a gift, they have to insist that we're only returning something they lost? Sounds like sheer jealousy and envy to me.
Stop lying about who invented the computer and the Internet and just accept it. No one keeps company or respects liars. Suse and Turing may as well be put in with the French loom as far as having invented a computer, which predates them by a few hundred years and was programmable.
None of the Suse, Turing, or Frenchie ideas though were computers.
Such jealousy.
It's actually an insult, to us, to the University, and to the city where America became Ameri ca. Why don't you try and enforce your theory of Internet copyrights with the United States Armed Forces; I'd like to see how far that gets these obviously false ideas about who invented what and who created what.
And if you can't say "Thanks" to America, then return the gift and just leave.
> No one keeps company or respects liars.
Good good, how's the solatary life then?
> The first computer was invented by J. Presper Eckert and John Mauchly at the University of Pensylvania, in Philadelphia, Pennsylvania in 1946.
You don't define "computer". Personally I feel that the gong goes to the German who built a working device to automatically calculate sums 153 years before America was founded:
http://en.wikipedia.org/wiki/History_of_computing_hardware "In 1623 Wilhelm Schickard built the first mechanical calculator and thus became the father of the computing era."
> The Internet was invented in America.
Again, your definintion of "internet" is vague. If you are talking about the first interconnected computers then indeed, that claim to fame probably goes to ARPANET. However, in reality the internet we know today was developed by TBL, at CERN, and then by W3C who have developed the standards which make it exactly what we now use.
http://en.wikipedia.org/wiki/Tim_berners-lee
But never minding that, your arrogance is entertaining. Please continue to enlighten us with your endless wisdom (ahem), and dim-witted insults.
Good good, how's the solatary life then?
> The first computer was invented by J. Presper Eckert and John Mauchly at the University of Pensylvania, in Philadelphia, Pennsylvania in 1946.
You don't define "computer". Personally I feel that the gong goes to the German who built a working device to automatically calculate sums 153 years before America was founded:
http://en.wikipedia.org/wiki/History_of_computing_hardware "In 1623 Wilhelm Schickard built the first mechanical calculator and thus became the father of the computing era."
> The Internet was invented in America.
Again, your definintion of "internet" is vague. If you are talking about the first interconnected computers then indeed, that claim to fame probably goes to ARPANET. However, in reality the internet we know today was developed by TBL, at CERN, and then by W3C who have developed the standards which make it exactly what we now use.
http://en.wikipedia.org/wiki/Tim_berners-lee
But never minding that, your arrogance is entertaining. Please continue to enlighten us with your endless wisdom (ahem), and dim-witted insults.
Yes, please don't stop, it is extremely entertaining and pathetic at the same time: To think that a great nation and people has been reduced to this. But I can't wait to read your next diatribe. I wonder if you know the meaning of hubris?
I didn't see an explanation for the "GIL".
I've opened a new q for so you may tell us how it really is...
https://www.experts-exchange.com/questions/21900641/The-General-Internet-License.html
I've opened a new q for so you may tell us how it really is...
https://www.experts-exchange.com/questions/21900641/The-General-Internet-License.html
None of the Zuse[sp], Turing, or Frenchie ideas though were computers.
Turing didn't design Colossus, it was Tommy Flowers. And it definitely was an electronic computer but it wasn't electronically programmed.
Turing didn't design Colossus, it was Tommy Flowers. And it definitely was an electronic computer but it wasn't electronically programmed.
I believe either the Babylonians or the Chinese invented the abacus betwee, 2400BC and 300BC. Since the beads maintain state, the abacus is programmable. Since it is also operated by the application of an algorithm stored in the memory of the operator via a low-bandwidth 10 bit wide wetware interface according to a strictly defined algorithm, I believe we have found the first computer. And anybody who dares state otherwise is potentially a liar, a communist and a terrorist sympathiser.
Actually, the first programable "computer" was a weaving loom created by Joseph Marie Jacquard in 1804.
http://tdi.uregina.ca/~complit/comphist.htm
>low-bandwidth 10 bit wide wetware interface ?????
LOW-bandwidth 10 bit wide ?!!??!?
baldrick, are you implying that ancient iraqis used their TOES! to interface with their abacii? I'm sure they used a 'higher' 10bit interface than that. Or would you describe toes as (even) lower 10bit bandwith?
Here in beautiful Ames, Iowa, we like to pretend that the Atanasoff-Berry Computer (which was really an electronic calculator) was the first in 1937. It WAS the first to use tubes to add numbers together.
LOW-bandwidth 10 bit wide ?!!??!?
baldrick, are you implying that ancient iraqis used their TOES! to interface with their abacii? I'm sure they used a 'higher' 10bit interface than that. Or would you describe toes as (even) lower 10bit bandwith?
Here in beautiful Ames, Iowa, we like to pretend that the Atanasoff-Berry Computer (which was really an electronic calculator) was the first in 1937. It WAS the first to use tubes to add numbers together.
:-)
That means, if you're only hitting root servers, you are not going to get an answer unless you accept other name servers [delgation]. If you're the root zone [the domain], then you must configure your Start of Authority to receive information from some other domain's name servers that are registry name servers, such as your ISP's name servers. They must allow and you must accept zone transfers. In most cases, you will not be allowed to update your ISP's name servers; it's a one-way ticket.
If, however, your domain is either webhosted or dnshosted, you may get some permissions to administer upstream name servers, but this is dangerous for the upstream server because one wrong record can mark that server as a "lame server."
A "lame server" will be ingnored by nearly all name servers after a time period wherein it consistently returns bad records. And if you run DNS in Windows, and you spew out bad records, you may, indeed, be marked as a "lame server."
This will cause lots of problems with name resolution.