Re: reverse lookups are shown as AUTHORITATIVE on cache servers..!!!

3 msg	Possible DOS Attack, but not sure.
2 msg	bind9-dlz
2 msg	connect from ouside to internal IP
4 msg	Zone Transfer from MS DNS to Bind
13 msg	Basic DNS Cache Server
10 msg	TCP Receive Error
8 msg	Bind Error
2 msg	localhost named[3700]: dispatch 0x82cf348: shut...
2 msg	DDNS Updates
2 msg	Problem 'exiting (due to assertion failure)'
4 msg	Setting up a DNS cache Server
5 msg	setting up mass subdomains and have immediate a...
1 msg	Estoy de vacaciones hasta el 30 de agosto
2 msg	lost bind process?
5 msg	question about split DNS
1 msg	max-cache-size problem
2 msg	strange behaviour...

reverse lookups are shown as AUTHORITATIVE on c...
\ blrmaani (28 Jul 2006)
. \ Barry Margolin (29 Jul 2006)

10 msg	diff. between 9.3.2 and 9.2.6
2 msg	Delegating issue

Subject:	Re: reverse lookups are shown as AUTHORITATIVE on cache servers..!!!
Group:	Bind-users
From:	Barry Margolin
Date:	29 Jul 2006

In article <ead9d2$2hsb$1>, "blrmaani" <blrmaani>
wrote:

> I have a cache-only server [ DNSHOST2 in the picture below ]
>
> DNSHOST1 ( authoritative DNS server for zone myzone1.com )
> |
> |
> DNSHOST2 ( cache only DNS server )
> |
> |
> CLIENTHOST
>
>
> I executed nslookup on CLIENTHOST to lookup names and ip-addresses on
> DNSHOST2.
> The nslookup was executed in debug mode.
>
>
> The replies for names shows as non-authoritative whereas replies for IP
>
> address shows as authoritative. I was under the impression that all
> cached
> replies are always non-authoritative.

What version of BIND is DNSHOST2 running? In older versions, if the
answer isn't already in the server's cache, so it has to recurse, it
simply passes the response that it gets from the authoritative server on
to the client. Any flags in this response, including the AA flag, will
be sent to the client.

If you then perform the same query again, it should already have the
answer cached, so this time it should be non-authoritative.

--
Barry Margolin, barmar
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***