elementary DNS facts

["D. J. Bernstein" <djb@cr.yp.to>]

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  your subscription address is
  54830374684695-namedroppers@sublist.cr.yp.to, please post from it or, if you
  wish to regularly post from an address that is not subscribed to this
  mailing list, send a message to namedroppers-owner@ops.ietf.org and ask to
  have the alternate address added to the list of addresses from which
  submissions are automatically accepted. ]

Danny Mayer writes:
> If you have two servers, one a master and the other the slave for a
> specific zone and the slave uses AXFR to transfer the zone from the
> master, can the slave ever give different answers to queries than what
> the master would respond as a result of the received zone?

Yes, of course. Suppose the server is also a slave for a child zone from
another master. If there's an inconsistency between the two masters,
it's obviously impossible to simultaneously (1) match what the parent
zone master says and (2) match what the child zone master says.

It's possible to match both for AXFR requests, as axfr-clarify demands,
but it's simply impossible to match both for normal queries, because
queries don't name zones. Matching is not part of the DNS protocol.

(See my message <20021124091420.47876.qmail@cr.yp.to> for an analysis of
what the protocol says about these inconsistencies.)

> If the answer is yes, something is wrong since you should get the same
> answer no matter which authorative server you ask. That's what I meant
> by broken.

You are fundamentally confused about how DNS works. See above.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago



--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>