If I'm reading this right, folks who have nameservers that don't have A RRs for their glue records will be out of luck come this March.  Saw this message come to NANOG the other day.

For example, I'm ok:

(outcry:15:17)% host -t ns prolixium.com.
prolixium.com name server ns3.antiderivative.net.
prolixium.com name server ns2.antiderivative.net.
(outcry:15:18)% host -t a ns2.antiderivative.net. a.gtld-servers.net.
Using domain server:
Name: a.gtld-servers.net.
Address: 2001:503:a83e::2:30#53
Aliases: 

ns2.antiderivative.net has address 69.9.186.232
(outcry:15:18)% host -t a ns2.antiderivative.net. 69.9.186.232 
Using domain server:
Name: 69.9.186.232
Address: 69.9.186.232#53
Aliases: 

ns2.antiderivative.net has address 69.9.186.232

But this guy isn't:

(outcry:15:18)% host -t ns 150dollarsites.com.
150dollarsites.com name server ns956.websitewelcome.com.
150dollarsites.com name server ns955.websitewelcome.com.
(outcry:15:19)% host -t a ns955.websitewelcome.com. a.gtld-servers.net. 
Using domain server:
Name: a.gtld-servers.net.
Address: 2001:503:a83e::2:30#53
Aliases: 

ns955.websitewelcome.com has address 174.120.61.226
(outcry:15:19)% host -t a ns955.websitewelcome.com. 174.120.61.226 
Using domain server:
Name: 174.120.61.226
Address: 174.120.61.226#53
Aliases: 

Host ns955.websitewelcome.com not found: 5(REFUSED)

Seems like just common sense.. but I guess DNS is one of those things that is often implemented poorly.

Update: Oh, yeah, I guess VeriSign is authoritative for edu., too.  Missed that.

New comments are currently disabled for this entry.