Why does dig +trace seem to ignore the DNS glue records

digdomain-name-systemglue-record

Here are my questions:

  • Why does dig +trace ignore the Glue Records?
  • Is this behavior specific to dig or dig +trace, or does a recursive name server also "manually verify" glue records it receives?

Here is the longer explanation:

This is the full capture of the DNS transaction that that prompted these questions.

I am using dig +trace to follow the DNS process for a simple A record resolution for www.pizza.com. As, expected, the first request was to my DNS server, looking for the Root Nameservers (Packet #1). My DNS Server then responds with the list of all 13 Name Servers (Packet #2):

packets 1 and 2

Note that in Packet#2, there are no Additional Records included. Which prompts my client to look up the A record for each of the provided Root name servers. Which happens in packets 3 thru 28:

packets 3 - 28

So far, this is expected. But next it gets interesting.

Packet 29 is my client, making a request to 192.5.5.241 (f.root-servers.net), looking for the A record for www.pizza.com. Obviously, the Root NS doesn't know the A record, so instead provides the .com TLD Name Servers' FQDNs (a.gtld-servers.net, b.gtld-servers.net, etc). Notice, the F Root NS also provides the "Additional Records", which are the A records corresponding to each of the .com TLD Name Server FQDNs:

Packets 29-30

What follows next is what my question revolves around. Even though my client received the A records correlating to the .com TLD name servers. It still decided to make an A record requests for each of the .com TLD name servers (packets 31-56):

Packets 31-56

The same thing happens just a bit further down (packets 57-66) when my client asks the .com TLD name servers for the A record for www.pizza.com, and receives the Authoritative NS records for the Pizza.com domain. The .com TLD Name servers provide the glue records, but my client still goes out and manually resolves each NS server's A record manually.

So my questions are:

  • Why does dig +trace ignore the Glue Records?
  • Is this behavior specific to dig or dig +trace, or does a recursive name server also "manually verify" glue records it receives?

I am using this version of Dig:
DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1

And ran this command:
$ dig www.pizza.com +trace -4


Edit 1: Added questions to the top as well, to make it easier to understand what I am inquiring about


Edit 2: This question is similar to mine, but not exactly the same. In this question, @Andrew B confirms the same behavior I am seeing:

+trace cheated and consulted the local resolver to obtain the IP address of the next hop nameserver instead of consulting the glue.

But my question is specifically why does dig +trace do that? What is the benefit? What is it trying to provide? It seems just like more work, that can sometimes even cause an inaccuracy in how dig resolves an address and how actual DNS resolves an address (as indicated by the other question).

The other question does seem to answer my second question, however. It seems this behavior of ignoring the glue records is specific to dig, and not how a "normal" recursive name server would act.

Best Answer

The official documentation says that dig can use glue records for subsequent queries but may revert to recursive queries if glue records are not provided [1]:

dig may still send queries to the servers listed in /etc/resolv.conf when using +trace When following delegation iteratively as specified with the +trace option, dig will begin by requesting the NS records for the servers authoritative for root ("."). These may or may not be supplied with glue - that is A and AAAA records that can be used for the next queries dig has to send. When there is no glue provided, either on the initial query for the root nameservers, or later on when following delegation, dig will revert to recursively querying the servers listed in /etc/resolv.conf to obtain the needed A/AAAA RRsets.

Specifying @server does not change this behaviour - the server specified in this way will only be queried for the NS records for the servers authoritative for root (".").

It might be wrong documentation or a bug in dig.

[1] https://kb.isc.org/docs/aa-00208

Related Topic