Sign up
Log in

DNS check Knowledge Base

Delegation consistency check

Prerequisites:

None.

Package:

Integrity.

Executed on:

All nameserver IP addresses, randomly selected parent DNS.

Check interval:

Every 5 minutes.

Impact on Availability:

None.

Impact on Integrity:

Medium.

Purpose

This check validates that the delegation information in the parent zone (usually TLD) matches the delegation information required in the child zone.

The fundamentals of the DNS and the domain name space are based on the relationship between parent (who is delegating the responsibility) and child (the responsible party).

The parent maintains a record of the name servers responsible for the delegated domain in order to guide resolvers to its destination. The child, in turn, has corresponding records in the domains zone file. If these records (NS) should differ worst case scenario is that the resolvers might not find the delegated domain.

When resolvers iterate the domain name tree to resolve client queries they receive referral records to name servers known by the parents. This procedure is repeated from the root level and down until the resolver gets the final response. Each parent will only know the name servers records (delegation records) registered in its respective zone. In this particular case the referral could point the resolver to a name sever that is no longer authoritative for the domain or in worst case scenario contain rouge information.

The check uses the parent NS records as the “truth” and compares what is registered in the parent with what is registered in all child servers.

NOTE!

Recent discoveries have found that unused names and IP address records found in the parent zone (a.k.a. Glue Records) can be targeted to hijack the zone. It is of the utmost importance that the records in the parent zone match those in the child zone.

Event severities and messages

INFO

Parent and child have matching values.
The check identified that the delegation information (NS resource records) is consistent between parent and child.

ERROR

Unrecognised records.
The check has identified records added to the child servers that are not listed in the parent zone. The parent zone should be updated with the correct NS resource records so that the load is distributed evenly across the authoritative DNS servers.

Missing records.
The check found that records found in the delegating (parents) servers weren’t found in the child servers. This error needs to be corrected because it can cause name lookup time-outs when resolvers try to resolve names from servers that don’t exist.
These error messages can be caused due to:

  • The DNS administrator has recently removed a name server and has yet to complete the registration process with the registrar.
  • The DNS administrator has completed the registration process with the registrar but the update has not yet been propagated. Note! Updates to TLD servers are usually run as scheduled batch jobs. Consult your registrar for the specific information about your top level domain.
  • The NS resource record could have been added to the registry by mistake.
  • The NS resource record could have been added to the registry by an unknown party in order to redirect part of the DNS queries. This could mean that the registry account is compromised by a possible DNS hijacking.

UNKNOWN

DNS error code
This message appears when a DNS server has failed to return an expected response. Please see the page Generic DNS response codes for additional information.

Solutions, tips & tricks

The delegation information should always be consistent between parent and child in order for the domain name space to work effectively.

We are aware of situations where the name server names in the parent are completely different from the name server names in the child. Delegation still works because both names end up resolving to the same IP addresses. This can cause the resolver to make additional iterations to complete queries, which ultimately affects resolution times. It doesn’t look good, and it’s bad practice.