Subject: Re: Primary vs. Secondary NS

From: "Mathias Körber" <[email-masked]>
Date: Sat, 10 Oct 1998 09:19:23 +0800

Jose,

you are exactly right. The concept of primary/secondary is *only* meaningful
for the authoritative nameservers themselves.

All the rest of the world only cares that this group makes up the
"authoritative" nameservers for the zone in question.

This is actually fairly obvious from the lack of distinction in NS records,
there is NO way a resolver can see the difference. More so, nameservers
actually do reorder the replied (in round-robin fashion), so that a resolver
would not even be guaranteed that the NS record for the primary is returned
first.

And finally, many people do not even list their primary nameserver in the NS
records (at either the NIC or in the zone itself), they only list
secondaries, and keep the primary secure behind a firewall (the only traffic
it sees are the zonetransfer requests from the published secondaries). This
concept is called 'stealth' and can also be used for secondaries (ie
secondaries can perform zonetransfers and actually be authoritative for a
zone, but not be listed in any NS records, and thus not visible to the
public).

Thus, as the rest of the world does not care whether a NS listed nameserver
is primary or secondary, they will just ask them in random order and take
the first reply that has the 'aa' (authoritative answer) set as good data
and then use it.

regards

---

From: Paul A Vixie <[email-masked]>
Date: Fri, 09 Oct 1998 21:05:10 -0700

in RFC 1996, the recommendation is made that if the SOA MNAME is the
same as one of the NS DNAMEs, then this designates the primary master
server.  that's as close as you can get to learning programmatically
that one of the listed nameservers is the primary.  and, since it is
optional, it is far from guaranteed.