4

I noticed the following odd behavior with AAAA records when querying existing A records. By base domains I mean domain names without subdomains. So when an A record exist and an AAAA record does not exist on specific records, I get a DNS response with "No errors" instead of getting the expected "Name error" flag.

Here are examples:

  1. Querying a domain with IPv6 support:

    nslookup -type=aaaa cisco.com
    Server:  google-public-dns-a.google.com
    Address:  8.8.8.8
    
    Non-authoritative answer:
    Name:    cisco.com
    Address:  2001:420:1101:1::a
    
  2. Querying a domain without IPv6 support:

    nslookup -type=aaaa microsoft.com
    Server: google-public-dns-a.google.com
    Address:  8.8.8.8
    
    Name:    microsoft.com
    

I would have expected:

nslookup -type=aaaa microsoft.com
Server: google-public-dns-a.google.com
Address:  8.8.8.8

*** google-public-dns-a.google.com can't find microsoft.com: Non-existent domain

Yet if I try a subdomain (example support.microsoft.com), the result will work for an A query, and the AAAA will return an empty result:

nslookup -type=a support.microsoft.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    e10315.g.akamaiedge.net
Address:  96.6.190.192
Aliases:  support.microsoft.com
          wildcard.support.microsoft.com.edgekey.net

AAAA:

nslookup -type=aaaa support.microsoft.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Non-authoritative answer:
Name:    support.microsoft.com

I would have expected:

nslookup -type=aaaa support.microsoft.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

*** google-public-dns-a.google.com can't find support.microsoft.com: Non-existent domain

Yet, when I query non-existing A & AAAA records, I get a proper answer on my AAAA queries... Is this by design or a DNS server bug? I wasn't able to find a reason for this behavior:

nslookup -type=aaaa dontexist.microsoft.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

*** google-public-dns-a.google.com can't find dontexist.microsoft.com: Non-existent domain
6

I actually found what I was looking for in RFC4074:

Suppose that an authoritative server has an A RR but has no AAAA RR for a host name. Then, the server should return a response to a query for an AAAA RR of the name with the response code (RCODE) being 0 (indicating no error) and with an empty answer section (see
Sections 4.3.2 and 6.2.4 of 1). Such a response indicates that there is at least one RR of a different type than AAAA for the queried name, and the stub resolver can then look for A RRs.

This explain exactly why we do not see "Record not found" for AAAA who have existing A records.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.