Subject: [dnsext] Glue at the zone cut ?

From: "John Levine" <[email-masked]>
Date: 7 Oct 2012 01:46:12 -0000

I see that DNS provisioning systems generally won't let you put a glue
record at the zone, cut, e.g. you can't do this:

$ORIGIN example.
 foo    NS foo
 foo    A  10.1.2.3

but you have to do this instead

 foo    NS ns.foo
 ns.foo A  10.1.2.3

Is there a technical reason not to allow the glue at the zone cut, or
is it just that it's ugly?  I know it's ugly, you don't have to tell
me that, the question is whether it breaks stuff.

R's,
John

---

From: Phil Regnauld <[email-masked]>
Date: Sun, 7 Oct 2012 04:01:19 +0200

> record at the zone, cut, e.g. you can't do this:

	Having written such software, I can say it's not something that was
	ever forbidden or treated any differently...

> me that, the question is whether it breaks stuff.

	I don't know about ugly, after all some people think A records at the
	zone apex are inelegant
	
	But it doesn't break anything, as far as I've tested.

	Cheers,
	Phil

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 07 Oct 2012 17:56:08 +0900

> record at the zone, cut, e.g. you can't do this:

that is a problem.

> but you have to do this instead

in addition, with the following example:

	foo	NS	ns.foo
		NS	ns.bar
	ns.foo	A	10.1.2.3
	bar	NS	ns.foo
		NS	ns2.foo

if ns.foo is down, neither foo nor bar is resolvable unless
the following glue

	ns2.foo	A	10.1.2.4

is added to zone bar.

> is it just that it's ugly?

The fundamental problem is zone content defined by rfc1034 is
broken a little. That is, in zone foo, the following
inconsistent glue A

	a.foo	NS	ns.bar
	ns.bar	A	10.1.2.3
	b.foo	NS	ns.bar
	ns.bar	A	192.168.1.2

should be able to be specified.

That is, glue A should be tagged with referral point as:

	ns.bar	A	10.1.2.3 (to be used for a.foo only)
	ns.bar	A	192.168.1.2 (to be used for b.foo only)

						Masataka Ohta

---

From: Måns Nilsson <[email-masked]>
Date: Mon, 8 Oct 2012 12:52:16 +0200

> me that, the question is whether it breaks stuff.

I run this in production and it is 

* a matter of taste. 

* technically correct. 

* to the best of my knowledge not a problem for dns software. 

The only things that break are badly designed provisioning systems. 

; <<>> DiG 9.6-ESV-R4-P3 <<>> @primary.se primary.se AXFR
; (2 servers found)
;; global options: +cmd
primary.se.		3600	IN	SOA	casper.besserwisser.org. mansaxel.besserwisser.org. 2011102301 600 1800 3600000 300
primary.se.		3600	IN	NS	ns.cafax.se.
primary.se.		3600	IN	NS	ns1.frobbit.se.
primary.se.		3600	IN	NS	primary.se.
primary.se.		3600	IN	NS	secondary.se.
primary.se.		3600	IN	NS	xn--domnhanteraren-r-buggig-x7b.primary.se.
primary.se.		3600	IN	A	192.36.115.53
primary.se.		3600	IN	AAAA	2a01:298:4::53
primary.se.		10	IN	MX	10 mx1.besserwisser.org.
www.primary.se.		3600	IN	CNAME	jaja.besserwisser.org.
xn--domnhanteraren-r-buggig-x7b.primary.se. 3600 IN A 192.36.115.53
xn--domnhanteraren-r-buggig-x7b.primary.se. 3600 IN TXT	"v=spf1 ip6:0::/0 -all"
xn--domnhanteraren-r-buggig-x7b.primary.se. 3600 IN TXT	"v=spf1 ip4:0.0.0.0/0 -all"
primary.se.		3600	IN	SOA	casper.besserwisser.org. mansaxel.besserwisser.org. 2011102301 600 1800 3600000 300
;; Query time: 12 msec
;; SERVER: 2a01:298:4::53#53(2a01:298:4::53)
;; WHEN: Mon Oct  8 12:47:28 2012
;; XFR size: 14 records (messages 1, bytes 440)

(the 5'th NS record points to a host name that post decoding says the
equivalent of "The DNS provisioning system at IIS.SE is b0rkened." Now
it's your turn to guess why I put that there ;-))

-- 
Måns Nilsson     primary/secondary/besserwisser/machina
MN-1334-RIPE                             +46 705 989668
I know th'MAMBO!!  I have a TWO-TONE CHEMISTRY SET!!

---

From: Peter Koch <[email-masked]>
Date: Mon, 8 Oct 2012 15:38:08 +0200

> record at the zone, cut, e.g. you can't do this:

could you be a bit more specific about 'generally'?  Is it registry/registrar
systems you are talking about or user interfaces for feeding (provisioning)
data into some DNS server?

> Is there a technical reason not to allow the glue at the zone cut, or

They are not special, just maybe counter intuitive.

-Peter