2

If you go on intodns.com and type in stackoverflow.com, the parent server tells me that nameservers for the domain are here:

ns1.serverfault.com.   ['198.252.206.80']   [TTL=172800] 
ns3.serverfault.com.   ['69.59.196.217']   [TTL=172800]  
ns4.serverfault.com.   ['69.59.196.122']   [TTL=172800] 
ns2.serverfault.com.   ['198.252.206.81']   [TTL=172800]

However, the zone file itself, which is authoritative, tells me that actually the nameservers are here instead:

ns2.serverfault.com  ['198.252.206.81']   [TTL=300] 
ns1.serverfault.com  ['198.252.206.80']   [TTL=300] 
ns3.serverfault.com  ['69.59.196.217']   [TTL=300]

Can any one explain why ns4.serverfault.com. would be listed as a nameserver when it isn't? What would happen if the resolver went to this address trying to find the A record for stackoverflow.com?

Lars
  • 407
  • 3
  • 10
  • ns4.serverfault.com *is* authoritative for stackoverflow.com; that is, it responds to a query with the `aa` flag set. If it were not authoritative, it would either be responding based on data cached based on other queries (which requires the `aa` flag be cleared), with a redirection toward the root servers (usually `.`) or with a query refusal. You can [use dig as exemplified in my answer to your other question](http://serverfault.com/a/526322/58408) to see this for yourself. Try asking ns4.serverfault.com for www.example.net and observe the difference (just don't overdo it). – user Jul 26 '13 at 10:36

1 Answers1

1

Whoever registered the domain name provided 4 nameservers to the registrar, so the registrar have added 4 glue NS records for the domain with the relevant addresses.

For some reason, which only stackoverflow will know, only 3 nameservers have been added to the zone file. While ideally the nameservers listed on a domain's registration (as visible in whois) should match what's in the zone file, these 2 lists come from different places and so it's possible for them to be different.

It appears that ns4 does actually work so any requests going to that IP address will get a response.

USD Matt
  • 5,321
  • 14
  • 23
  • Oddly enough, querying each of the four glue records for `serverfault.com NS` returns all four namesevers. I'm not sure why intodns would be reporting this. Assuming the SOA is accurate (yeah yeah I know), it was last updated on the 21st and the TTL is only 300. – Andrew B Jul 26 '13 at 15:04