Subject: Primary vs. Secondary NS

From: "Jose R. Cordones" <[email-masked]>
Date: Fri, 9 Oct 1998 15:10:29 -0400 (EDT)

Hello, this is my first post to the list, so allow me to introduce myself.
I am the Network/Systems Administrator for an ISP in the NYC area.

Recently, I have had this debate and I would like to find out what the
folks at namedroppers think about it.  It involves the concepts of primary
and secondary nameservers.

I maintain that "primary" and "secondary" mean nothing to resolvers using
a nameserver, and it certainly means nothing to InterNIC and the
root-servers.net servers.

When one registers a domain, InterNIC asks for "primary" and "secondary"
etc. etc. NS, yet for ages WHOIS was far more modest and said of domains:

Nameservers in listed order:

So when a resolver (or a NS resolving a query on behalf of a resolver)
gets a NS RR for domain.com, it is being told: "these NS should be able to
help you about domain.com." then when ANY of those NS are queried about
domain.com, they most likely respond with the requested information.

I have seen BIND have settings to have it do address sorting, etc. for
some years now, and any nameserver out there is supposed to exhaustively
try all the NS listed for a domain, until it has tried them all while
getting a negative response from each, or it has tried each several
times (I remember this was kinda implementation dependent) and has timed 
out, so nowhere is anyone saying "hey, NS #1 is more important than NS
#2", all we care is that ONE of them replies.

Now, when the "host" utlity or any other out there talk about the host
being non-authoritative, they are talking about the fact that because they
didn't get the information from the original NS themselves (or perhaps,
because THEY are not the original NS giving out the answer), that
information should be considered non-authoritative.

Then we have the SOA entry, etc. saying where we claim the information
originated, etc. but all of this is arbitrary.

A further complication is that then inside the zone file, we have again
mention of who the NS for the zone are, which may or may not match what
Internic has.

Often you have that somone suposed to act as secondary for a domain begins
acting as primary, which is entirely a named.boot setting, and anyone who
queries the second (fake) primary, trusts the information in there,
however stale it may be.

Sorry to be long-winded, but my point is that ppl are misled by the
concepts of "Primary" and "Secondary" as listed on InterNIC's
Registration form and then think that if I'm their Primary, it is pretty
much impossible for a secondary out there to cause major disasters.
Such has been my case at work, and it's taken me weeks of tracking down
tens of domains, and in each case I have been able to point out to my
upstream DNS secondary "you messed up domain xyz.com, you have serial
number 103, I have serial number 1998100901, who told you that you were a
primary for them?", note how the yyyymmddnn notation for serials has come
quite handy for me.  What then some people in charge don't believe is the
incidence that a stale zone file upstream has on dns resolution.
Other sites will probably either "address sort" or simply realize that the
upstream site is closer either time or hop-wise and keep on querying it,
not my site.

So, this explains my telling these people that "primary" and "secondary"
are very arbitrary terms that refer to which of the listed NS, in theory,
should be generating the information (me) and who should be pulling it off
of me (the other NS.) But as far as anyone out there resolving is
concerned, any secondary's stale zone file is just as recent as my
up to date information.

Any comments?

Jose R. cordones