Tracing Name Resolution Using dig
.13.1 Problem
You want to trace the process of name resolution using dig.
.13.2 Solution
Starting with a root name server, send nonrecursive queries (with the +norec command-line option) for the records you e looking for. (The root name servers are named [a-m].root-servers.net.) For example:
$ dig @a.root-servers.net www.oreilly.com +norec ; <<>> DiG 9.2.1 <<>> @a.root-servers.net www.oreilly.com +norec ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44699 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 13 ;; QUESTION SECTION: ;www.oreilly.com. IN A ;; AUTHORITY SECTION: com. 172800 IN NS A.GTLD-SERVERS.NET. com. 172800 IN NS G.GTLD-SERVERS.NET. com. 172800 IN NS H.GTLD-SERVERS.NET. com. 172800 IN NS C.GTLD-SERVERS.NET. com. 172800 IN NS I.GTLD-SERVERS.NET. com. 172800 IN NS B.GTLD-SERVERS.NET. com. 172800 IN NS D.GTLD-SERVERS.NET. com. 172800 IN NS L.GTLD-SERVERS.NET. com. 172800 IN NS F.GTLD-SERVERS.NET. com. 172800 IN NS J.GTLD-SERVERS.NET. com. 172800 IN NS K.GTLD-SERVERS.NET. com. 172800 IN NS E.GTLD-SERVERS.NET. com. 172800 IN NS M.GTLD-SERVERS.NET. ;; ADDITIONAL SECTION: A.GTLD-SERVERS.NET. 172800 IN A 192.5.6.30 G.GTLD-SERVERS.NET. 172800 IN A 192.42.93.30 H.GTLD-SERVERS.NET. 172800 IN A 192.54.112.30 C.GTLD-SERVERS.NET. 172800 IN A 192.26.92.30 I.GTLD-SERVERS.NET. 172800 IN A 192.43.172.30 B.GTLD-SERVERS.NET. 172800 IN A 192.33.14.30 D.GTLD-SERVERS.NET. 172800 IN A 192.31.80.30 L.GTLD-SERVERS.NET. 172800 IN A 192.41.162.30 F.GTLD-SERVERS.NET. 172800 IN A 192.35.51.30 J.GTLD-SERVERS.NET. 172800 IN A 210.132.100.101 K.GTLD-SERVERS.NET. 172800 IN A 192.52.178.30 E.GTLD-SERVERS.NET. 172800 IN A 192.12.94.30 M.GTLD-SERVERS.NET. 172800 IN A 192.55.83.30 ;; Query time: 84 msec ;; SERVER: 198.41.0.4#53(a.root-servers.net) ;; WHEN: Fri Jun 28 11:53:41 2002 ;; MSG SIZE rcvd: 465
When you receive a referral (a response with a NOERROR status, no answer section, and NS records in the authority section), send your next query to one of the name servers in the authority section. Well query m.gtld-servers.net next:
$ dig @m.gtld-servers.net www.oreilly.com +norec ; <<>> DiG 9.2.1 <<>> @m.gtld-servers.net www.oreilly.com +norec ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53652 ;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.oreilly.com. IN A ;; AUTHORITY SECTION: oreilly.com. 172800 IN NS NS.oreilly.com. oreilly.com. 172800 IN NS NS1.SONIC.NET. ;; ADDITIONAL SECTION: NS.oreilly.com. 172800 IN A 209.204.146.21 NS1.SONIC.NET. 172800 IN A 208.201.224.11 ;; Query time: 251 msec ;; SERVER: 192.55.83.30#53(m.gtld-servers.net) ;; WHEN: Fri Jun 28 12:06:26 2002 ;; MSG SIZE rcvd: 109
Now well query ns.oreilly.com:
$ dig @ns.oreilly.com www.oreilly.com +norec ; <<>> DiG 9.2.1 <<>> @ns.oreilly.com www.oreilly.com +norec ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36079 ;; flags: qr aa ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.oreilly.com. IN A ;; ANSWER SECTION: www.oreilly.com. 7200 IN A 209.204.146.22 ;; AUTHORITY SECTION: oreilly.com. 7200 IN NS ns2.sonic.net. oreilly.com. 7200 IN NS ns.oreilly.com. oreilly.com. 7200 IN NS ns1.sonic.net. ;; ADDITIONAL SECTION: ns.oreilly.com. 7200 IN A 209.204.146.21 ns2.sonic.net. 80335 IN A 208.201.224.33 ;; Query time: 254 msec ;; SERVER: 209.204.146.21#53(ns.oreilly.com) ;; WHEN: Fri Jun 28 12:07:01 2002 ;; MSG SIZE rcvd: 143
This response has the record we were after in the answer section, so we e done.
.13.3 Discussion
Notice that the query doesn change: in this example, we look up A records for www.oreilly.com each time. By following the referrals, we get closer and closer to the name servers authoritative for the zone that contains the answer.
BIND 9s version of dig has a command-line option to trace name resolution automatically -- very slick! To reproduce the output above, you only need to run:
$ dig +trace www.oreilly.com
dig starts by looking up the list of root name servers on your default name server, then sends a nonrecursive query to one of them for the records you specified on the command line. Then it follows referrals, as we did, until it finds an answer.
If you e trying to track down a problem, not just reenacting name resolution for personal or pedagogical reasons, pay careful attention to digs output. Look for responses that indicate that the domain name doesn exist (NXDOMAIN in the status field of the header) or that refer you to name servers authoritative for a zone higher up in the namespace (for example, an oreilly.com name server referring you to a com name server), which is a symptom of a lame delegation.
.13.4 See Also
dig(1); and Section 6.6, for using digs +trace option to check delegation.
Getting Started
- Introduction
- Finding More Information About DNS and BIND
- Asking Questions You Cant Find Answers To
- Getting a List of Top-Level Domains
- Checking Whether a Domain Name Is Registered
- Registering a Domain Name
- Registering Name Servers
- Registering a Reverse-Mapping Domain
- Transferring Your Domain Name to Another Registrar
- Choosing a Version of BIND
- Finding Out Which Version of BIND Youre Running
- Getting BIND
- Building and Installing BIND
- Getting a Precompiled Version of BIND
- Creating a named.conf File
- Configuring a Name Server as the Primary Master for a Zone
- Configuring a Name Server as a Slave for a Zone
- Configuring a Name Server as Authoritative for Multiple Zones
- Starting a Name Server
- Stopping a Name Server
- Starting named at Boot Time
Zone Data
- Introduction
- Creating a Zone Data File
- Adding a Host
- Adding an Alias
- Adding a Mail Destination
- Making the Domain Name of Your Zone Point to Your Web Server
- Pointing a Domain Name to a Particular URL
- Setting Up Round Robin Load Distribution
- Adding a Domain Name in a Subdomain Without Creating a New Zone
- Preventing Remote Name Servers from Caching a Resource Record
- Adding a Multihomed Host
- Updating a Name Servers Root Hints File
- Using a Single Data File for Multiple Zones
- Using Multiple Data Files for a Single Zone
- Resetting Your Zones Serial Number
- Making Manual Changes to a Dynamically Updated Zone
- Moving a Host
- Mapping Any Domain Name in a Zone to a Single IP Address
- Adding Similar Records
- Making Your Services Easy to Find
- Storing the Location of a Host in DNS
- Filtering a Host Table into Zone Data Files
BIND Name Server Configuration
- Introduction
- Configuring a Name Server to Work with ndc
- Configuring a Name Server to Work with rndc
- Using rndc with a Remote Name Server
- Allowing Illegal Characters in Domain Names
- Dividing a Large named.conf File into Multiple Files
- Organizing Zone Data Files in Different Directories
- Configuring a Name Server as Slave for All of Your Zones
- Finding an Offsite Slave Name Server for Your Zone
- Protecting a Slave Name Server from Abuse
- Allowing Dynamic Updates
- Configuring a Name Server to Forward Dynamic Updates
- Notifying a Slave Name Server Not in a Zones NS Records
- Limiting NOTIFY Messages
- Configuring a Name Server to Forward Queries to Another Name Server
- Configuring a Name Server to Forward Some Queries to Other Name Servers
- Configuring a Name Server Not to Forward Certain Queries
- Returning Different Answers to Different Queriers
- Determining the Order in Which a Name Server Returns Answers
- Setting Up a Slave Name Server for a Zone in Multiple Views
- Disabling Caching
- Limiting the Memory a Name Server Uses
- Configuring IXFR
- Limiting the Size of the IXFR Log File
- Configuring a Name Server to Listen Only on Certain Network Interfaces
- Running a Name Server on an Alternate Port
- Setting Up a Root Name Server
- Returning a Default Record
- Configuring DNS to Let Clients Find the Closest Server
- Handling Dialup Connections
Electronic Mail
- Introduction
- Configuring a Backup Mail Server in DNS
- Configuring Multiple Mail Servers in DNS
- Configuring Mail to Go to One Server and the Web to Another
- Configuring DNS for Virtual Email Addresses
- Configuring DNS So a Mail Server and the Email It Sends Pass Anti-Spam Tests
BIND Name Server Operations
- Introduction
- Figuring Out How Much Memory a Name Server Will Need
- Testing a Name Servers Configuration
- Viewing a Name Servers Cache
- Flushing (Clearing) a Name Servers Cache
- Modifying Zone Data Without Restarting the Name Server
- Adding or Removing Zones Without Restarting or Reloading the Name Server
- Initiating a Zone Transfer
- Restarting a Name Server Automatically If It Dies
- Restarting a Name Server with the Same Arguments
- Controlling Multiple named Processes with rndc
- Controlling Multiple named Processes with ndc
- Finding Out Whos Querying a Name Server
- Measuring a Name Servers Performance
- Measuring Queries for Records in Particular Zones
- Monitoring a Name Server
- Limiting Concurrent Zone Transfers
- Limiting Concurrent TCP Clients
- Limiting Concurrent Recursive Clients
- Dynamically Updating a Zone
- Sending Dynamic Updates to a Particular Name Server
- Setting Prerequisites in a Dynamic Update
- Sending TSIG-Signed Dynamic Updates
- Setting Up a Backup Primary Master Name Server
- Promoting a Slave Name Server to the Primary Master
- Running Multiple Primary Master Name Servers for the Same Zone
- Creating a Zone Programmatically
- Migrating from One Domain Name to Another
Delegation and Registration
- Introduction
- Delegating a Subdomain
- Delegating a Subdomain of a Reverse-Mapping Zone
- Delegating Reverse-Mapping for Networks with Non-Octet Masks
- Delegating Reverse-Mapping for Networks Smaller than a /24
- Checking Delegation
- Moving a Name Server
- Changing Your Zones Name Servers
Security
- Introduction
- Concealing a Name Servers Version
- Configuring a Name Server to Work with a Firewall (or Vice Versa)
- Setting Up a Hidden Primary Master Name Server
- Setting Up a Stealth Slave Name Server
- Configuring an Authoritative-Only Name Server
- Configuring a Caching-Only Name Server
- Running a Name Server in a chroot( ) Jail
- Running the Name Server as a User Other than Root
- Defining a TSIG Key
- Securing Zone Transfers
- Restricting the Queries a Name Server Answers
- Preventing a Name Server from Querying a Particular Remote Name Server
- Preventing a Name Server from Responding to DNS Traffic from Certain Networks
- Protecting a Name Server from Spoofing
Interoperability and Upgrading
- Introduction
- Upgrading from BIND 4 to BIND 8 or 9
- Upgrading from BIND 8 to BIND 9
- Configuring a Name Server to Accommodate a Slave Running BIND 4
- Configuring a BIND Name Server to Accommodate a Slave Running the Microsoft DNS Server
- Configuring a BIND Name Server as a Slave to a Microsoft DNS Server
- Preventing Windows Computers from Trying to Update Your Zones
- Handling Windows Registration with a BIND Name Server
- Handling Active Directory with a Name Server
- Configuring a DHCP Server to Update a BIND Name Server
Resolvers and Programming
- Introduction
- Configuring a Resolver to Query a Remote Name Server
- Configuring a Resolver to Resolve Single-Label Domain Names
- Configuring a Resolver to Append Multiple Domain Names to Arguments
- Sorting Multiple Addresses in a Response
- Changing the Resolvers Timeout
- Configuring the Order in Which a Resolver Uses DNS, /etc/hosts, and NIS
- Looking Up Records Programmatically
- Transferring a Zone Programmatically
- Updating a Zone Programmatically
- Signing Queries and Dynamic Updates with TSIG Programmatically
Logging and Troubleshooting
- Introduction
- Finding a Syntax Error in a named.conf File
- Finding a Syntax Error in a Zone Data File
- Sending Log Messages to a Particular File
- Discarding a Category of Messages
- Determining Which Category a Message Is In
- Sending syslog Output to Another Host
- Logging Dynamic Updates
- Rotating Log Files
- Looking Up Records with dig
- Reverse-Mapping an Address with dig
- Transferring a Zone Using dig
- Tracing Name Resolution Using dig
IPv6
