RE: [cobalt-users] NSLOOKUP Produces Non-Authoritative Answer to queries

[Elmer Fuddpucker <elmer@xxxxxxxxxxxxxx>]

On Fri, 1 Jun 2001, Dan Kriwitsky wrote:

} I don't have the book to look it up in, but my guess would be it doesn't
} refer to doing a lookup on the DNS server that's supposed to be
} authoritative for the domain in question.

sometimes we miss the basic simplicities of things...

	The situation is this. The first lookup (the keyword being
lookup) is always authoritative. The second lookup (the keyword
being lookup) will be non-authoritative as the answer is supplied
out of the cache. The thing is that a truly authoritative name
server does not do a "lookup" - it has the zone and just answers the
query with the information it is authoritative for.

	I didn't follow the thread so I can't be authoritative as to
what the cause of the problem is, and I'm simply too busy to
trouble shoot the zone for someone else's client but the clue that I
saw everyone missing is that a lookup is being done. In other words,
the actual authoritative name server is not being directly queried.
The setup could, for example, be that of a virtual name server
which is claiming to be authoritative for machine on which an
authoritative name server is indeed running or some such thing.

	Regardless of how one cut's it, or how it was done, the
situation is that a non-authoritative name server is being
perceived as authoritative and that that non-authoritative name
server already done did it's lookup and is now responding with the
data in it's cache. That's absolutely all there is to it. Like it or
not, that's the way named works. Thus, DNS may very well not be
broke and the real question is why is this is occurring.

	Without knowing anything more than I do - why are the
answers always non-authoritative - my guess is that there isn't a
problem here at all but that the name server being seen as
authoritative is actually a virtual name server. If not then the
system admin inadvertently setup a virtual name server in a manner
such as that explained in a post about an hour ago by someone who
inadvertently did the same in a manner which I don't recall.

	Everybody that's been doing this stuff for any length of
time has done something similar - myself included - so it ain't like
I'm pinging on someone. I'm just pointing out the facts. This may be
as simple as a slighly confused (join the club) system admin who
just got his name servers mixed up in the excitement of going live.

	brent

	Elmer Fuddpucker's WWW Directory
	http://www.fuddpucker.com/