How to force my computer to only use authoritative name servers when performing DNS lookups

Question

When using nslookup, this is the output when sshed into school linux server:

user_name@csil-cpu6:~$ nslookup -type=NS ox.ac.uk
Server:     142.58.190.5
Address:    142.58.190.5#53

Non-authoritative answer:
ox.ac.uk    nameserver = dns2.ox.ac.uk.
ox.ac.uk    nameserver = ns2.ja.net.
ox.ac.uk    nameserver = dns1.ox.ac.uk.
ox.ac.uk    nameserver = dns0.ox.ac.uk.

Authoritative answers can be found from:
dns0.ox.ac.uk   internet address = 129.67.1.190
dns1.ox.ac.uk   internet address = 129.67.1.191
ns2.ja.net  internet address = 193.63.105.17
ns2.ja.net  has AAAA address 2001:630:0:45::11
dns2.ox.ac.uk   internet address = 163.1.2.190

But this is the output from home computer:

Sun Apr 09 15:30 user_name:/Users/user_name$nslookup -type=NS ox.ac.uk
Server:     192.168.1.254
Address:    192.168.1.254#53

Non-authoritative answer:
ox.ac.uk    nameserver = ns2.ja.net.
ox.ac.uk    nameserver = dns2.ox.ac.uk.
ox.ac.uk    nameserver = dns0.ox.ac.uk.
ox.ac.uk    nameserver = dns1.ox.ac.uk.

Authoritative answers can be found from:

Sun Apr 09 17:56 user_name:/Users/user_name$

How can I get my computer to use authoritative DNS servers for its lookup?

Answer 1

Twisty's answer is correct in the strictest sense of the question.

However, you can achieve the practically intended result by running a full DNS resolver – the kind that ISPs and public DNS servers use. This type of resolver doesn't rely on a single "upstream" server, but rather starts lookup from the DNS root and chases referrals until it finds the correct authoritative server. (The referrals themselves also come from the server that would be authoritative for that information, even though they don't have the "authoritative" flag.)

1. query . nameservers: "do you have www.example.com/A?" "no, but I have com/NS"
2. query com. nameservers: "do you have www.example.com/A?" "no, but I have example.com/NS"
3. query example.com. nameservers: "do you have www.example.com/A?" "yes, here's an authoritative answer on that"

(This is also called an 'iterative' query and is part of the design of DNS – it's how your ISP finds the authoritative servers for each domain, it's how 8.8.8.8 finds the authoritative servers, and so on.)

For Linux systems, usual choices are "Unbound", ISC BIND 9, "Knot Resolver".

Note that this will not make tools such as nslookup or ping make direct queries to the authoritative servers. They do not have the functionality for that; they rely on a recursive resolver – whether it's your ISP's or whether it's Unbound on the same PC, that's the only kind they can use.

Answer 2

It is impossible for a computer to query only authoritative DNS name servers. In order to do that, it would need to know in advance the address of the authoritative name server for every domain on the Internet.

To do this one would need to create and then maintain an accurate database of this information. But the highly dispersed and dynamic nature of the Internet makes this impossible.

Supposing you could even compile an accurate list of domains and their authoritative nameservers, keeping such a list up-to-date would require that any change to which servers are authoritative for what domains be reported to you as maintainer of this database (or in your case, your computer), because there's no other practical way to discover that these changes have occurred.

That simply isn't going to happen.

The whole point of the DNS system is to make it possible find the IP address of systems hosted by a particular domain without requiring this impossible to maintain central database. The only thing "central" about DNS is the root servers, they themselves which only provide referrals to other servers as part of the lookup process. Thanks to DNS, individual domain owners can come and go at will and add and remove records at will and others on the Internet can find them trivially. This is all due to the fact the root servers refer requests to top level domain servers which in turn refer requests on down the line until they arrive at an authoritative server for the domain.

Answer 3

An authoritative name server only returns answers to queries about domain names that are configured on its system. So dns0.ox.ac.uk and dns1.ox.ac.uk control the actual DNS records (A, CNAME, MX, etc.) for ox.ac.uk.

But, in your case, this is only true for ox.ac.uk. If you were to look up example.com while on the school network, you would receive a non-authoratative answer (because dns0.ox.ac.uk and dns1.ox.ac.uk do not control the records for example.com -- a.iana-servers.net and b.iana-servers.net do).

So unless you are able to get access to every DNS server/network everywhere, you are probably going to receive a lot of non-authoratative answers.