It works as expected. The incorrect assumption here is that all names should have NS
records.
Instead, the set of nameservers is defined on a per zone basis, with NS
records at the zone apex only.
Eg, if you have example.com
and have not delegated any subdomains elsewhere, then there are no further NS
records anywhere under example.com.
If you delegate foo.bar.example.com
elsewhere, then that name (by definition the start of a new zone) will have NS
records.
There are several possible approaches for finding which zone a given name is part of. It's actually generally a two-step process.
One approach would be to start out with eg:
dig HDRedirect-LB3-890977680.us-east-1.elb.amazonaws.com NS
The idea here is that if this name happens to be the apex of a zone (something which you cannot generally know in advance) you get the response that you want.
If it is not the zone apex, you will get a negative response (as there are no NS
records in that case), but that negative response includes the zone's SOA
in the AUTHORITY
section. That SOA
record will actually tell you where the apex is.
In this case
;; AUTHORITY SECTION:
us-east-1.elb.amazonaws.com. 32 IN SOA ns-1119.awsdns-11.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60
So the owner name (left-most column) of the SOA
record tells you where the zone starts.
Ie, dig us-east-1.elb.amazonaws.com. NS
will give you the relevant nameservers.
Another approach would be to follow the chain of delegations (eg dig +trace
) but in the end that ends up being a case of remembering the last delegation point you saw. Also, if you take this approach and use dig +trace
specifically, do keep in mind that the output of dig +trace
by default is very limited and does not really distinguish between the NS
records from AUTHORITY
sections when it gets a referral from a parent zone compared to an NS
record in the ANSWER
section from the actual authoritative nameserver.
(You may want to add +all
to actually see clearly what is happening.)
In the end, if you only saw the referral (with NS
records in the AUTHORITY
section) and want to be sure you have the NS
records that the authoritative server says, you will have to re-query for that particular name.