Re: [dnsext] Short introduction to zone cuts?

On 3/19/2012 7:58 AM, Ray Bellis wrote:
> 
> On 18 Mar 2012, at 01:36, Doug Barton wrote:
> 
>> I'm not sure what you mean by "works" here.
> 
> I mean the NAPTR records correctly resolve.
> 
>> If you mean that anyone using ns1.example.com directly will see
>> those records, then yes, it works -- for those users. But assuming
>> that ns1.example.com is not included in the NS set of the parent
>> zone, no one else will see the 2 NAPTR records you listed above. So
>> in that sense it doesn't work ... at least, it doesn't work the way
>> that the administrator of ns1.example.com wants it to.
> 
> No, in this case "ns1.example.com" _is_ found via the parent zone,
> but the delegation is four nodes further down the DNS tree than the
> child's SOA / NS records would indicate.

Right, and that's the devious subtlety of your message. :)  No one would
ever query ns1.example.com iteratively for the sample records in the
zone you posted because they would have no way of knowing that
ns1.example.com thought it was authoritative for those records.

Clients querying it directly would get an answer (think in-house
resolvers with various in-house zones slaved to it) but no one else would.

Doug

-- 
    If you're never wrong, you're not trying hard enough
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext