Is it possible to have a DNS NS record point to a domain from outside the queried nameserver's domain?

Question

For example, say you lookup ns records for df.uba.ar by querying uba.ar's nameserver, say ns.uba.ar.

Can a record from that query refer you to the nameserver of df.uba.ar at an address completely outside the queried nameserver's domain, say, at mynameserver.net, is that possible?

I think so. Name servers just live whatever hostname is assigned to them. But they should be comprehensive for all TLDs and such. — Giacomo1968, Sep 24 at 2:56

davidgo · Accepted Answer · 2023-09-24 05:06:33Z

Yes, absolutely you can delegate subdomains using NS records - this is the way DNS is designed - and indeed this is likely already happening at higher levels. (There is an idea of recursive nameservers - which are the general servers clients use - and they use this mechanism extensively)

Lets assume you have a domain name example.co.uk.

The root nameservers know where to find ".uk" CCTLD domains (they are hard-coded using glue records). The recursive nameserver you query then does the following:

Queries the uk nameserver to get co.uk nameservers.
Queries .co.uk nameserver to get the example.co.uk nameservers

So if you have my.example.co.uk its just another level of querying - 3. Queries example.co.uk nameservers to get my.example.co.uk 4. Queries my.example.co.uk nameserver to get the A or other records.

To demonstrate I set up a subdomain "test.host.net.nz" (I own host.net.nz) by specifying nameservers and a separate zone for test.host.net.nz for you. (While I used my nameservers for the subdomain, it works similarly if you point to different nameservers)

If you use Linux you can see this behaviour with a command like

 dig +trace test.host.net.nz

The output I get is

 $ dig +trace test.host.net.nz

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> +trace test.host.net.nz
;; global options: +cmd
.           7051    IN  NS  b.root-servers.net.
.           7051    IN  NS  f.root-servers.net.
.           7051    IN  NS  l.root-servers.net.
.           7051    IN  NS  k.root-servers.net.
.           7051    IN  NS  m.root-servers.net.
.           7051    IN  NS  h.root-servers.net.
.           7051    IN  NS  i.root-servers.net.
.           7051    IN  NS  g.root-servers.net.
.           7051    IN  NS  c.root-servers.net.
.           7051    IN  NS  d.root-servers.net.
.           7051    IN  NS  a.root-servers.net.
.           7051    IN  NS  e.root-servers.net.
.           7051    IN  NS  j.root-servers.net.
;; Received 811 bytes from 127.0.0.53#53(127.0.0.53) in 4 ms

nz.         172800  IN  NS  ns1.dns.net.nz.
nz.         172800  IN  NS  ns2.dns.net.nz.
nz.         172800  IN  NS  ns3.dns.net.nz.
nz.         172800  IN  NS  ns4.dns.net.nz.
nz.         172800  IN  NS  ns5.dns.net.nz.
nz.         172800  IN  NS  ns6.dns.net.nz.
nz.         172800  IN  NS  ns7.dns.net.nz.
nz.         86400   IN  DS  13646 8 2 569B1BAE369FD18F03D088FBA91BD58A830E4E21D2C96155CED26754 4CAC14B1
nz.         86400   IN  DS  49157 8 2 44628E9BF710B40D5A5B19087A119EAF2C0B5CED7E7BA4268F4FC35B EF14B1C0
nz.         86400   IN  DS  63529 8 2 65C9663EACC1AD314058A5A7B127D409D144BBA9A58EC0B6A7F4F028 574DF47B
nz.         86400   IN  RRSIG   DS 8 1 86400 20231006170000 20230923160000 11019 . Mo/4OJSg4zaXeJw0QMt4RwUqS2uXDlD0BFw4BvNSwomfVILPoH0JI6jC b/AgP4uQdyyR9DPO6iXBsBrOkOkp2BWIbMjyhfLmO8GRT/+cxfVKcp6B PVO2jdrKHHN0EBj3kFUUhcdU/ZMgki4wJpMmuhMJT9uPOYrEBZQsUN5E P0s8zCfoqoFY86SMJRs1S57bRGCpyKoN0kdc2kvxP1RfCUNRmcMhS67J 00Fqhv8M7VgBuL+GoF//OfHDK9txtrmEquJPqAXG3Y70Aj3b2kKUZtWe xFBUr+K3n+eADBRO1AlUEs2VC909KW553pZ+n7i0nr4y8RX/6Bz41/9t OJGyPw==
;; Received 914 bytes from 192.58.128.30#53(j.root-servers.net) in 28 ms

;; UDP setup with 2001:67c:1010:13::53#53(2001:67c:1010:13::53) for test.host.net.nz failed: network unreachable.
;; UDP setup with 2001:67c:1010:13::53#53(2001:67c:1010:13::53) for test.host.net.nz failed: network unreachable.
;; UDP setup with 2001:67c:1010:13::53#53(2001:67c:1010:13::53) for test.host.net.nz failed: network unreachable.
;; UDP setup with 2620:10a:80aa::130#53(2620:10a:80aa::130) for test.host.net.nz failed: network unreachable.
host.net.nz.        86400   IN  NS  dns2.networksavvy.org.
host.net.nz.        86400   IN  NS  dns2.host.net.nz.
host.net.nz.        86400   IN  NS  dns1.host.net.nz.
host.net.nz.        86400   IN  NS  dns1.networksavvy.org.
ftq1sc65oboavpm01b73vht98aj0j7s4.net.nz. 3600 IN NSEC3 1 1 5 A28B2E20D85645FC FUJ14F0PIO5AL96LCFM2L3JH1E7UTRTM NS SOA RRSIG DNSKEY NSEC3PARAM
ftq1sc65oboavpm01b73vht98aj0j7s4.net.nz. 3600 IN RRSIG NSEC3 8 3 3600 20230929233149 20230923151828 55531 net.nz. GfoNDCz/ybU9LbfNzTf9knywysakZv6SL4hUVllv5OPXQyv3iPtKZdOg hngu+PyeSrfMlfDGuLTNQk3kOqS+iGGXZMpnFSdZweHevtJgY8Whqzz0 YP1R1p8XakEJ997RGf2IePCRBp9ZgLNeg+wC3PLOjW3tPXeWAkuT8+Pi V+Q=
9ct1bpg4b0gddtpcq1pburmco2sepqf4.net.nz. 3600 IN NSEC3 1 1 5 A28B2E20D85645FC 9JCPVKID50C1OU9KTMJ30RA7SMV8P01M NS DS RRSIG
9ct1bpg4b0gddtpcq1pburmco2sepqf4.net.nz. 3600 IN RRSIG NSEC3 8 3 3600 20230929191943 20230924034536 55531 net.nz. VpOzawDkNFCy+pPyM3qE0m4/B1yN/vVgQNYM4yoKdIOEayj3wF8J8UVv 1z9vOK1lOORCe1Jg3cJ+ysocogqdV9ER1mCTuvp3PqXmWP1eSOpXYqBj O6ez6mR2wHTkk8mbXO0mD1y1MicNnSHCu2dRBVWJr06slE/SDtjCh/XM 6fk=
;; Received 704 bytes from 202.46.188.130#53(ns3.dns.net.nz) in 12 ms

test.host.net.nz.   3600    IN  A   60.234.77.236
;; Received 61 bytes from 60.234.77.225#53(dns2.host.net.nz) in 0 ms

davidgo@blisscms:/var/www/virtual/cms.networksavvy.org/public_html/bliss3$ dig +trace test.host.net.nz

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> +trace test.host.net.nz
;; global options: +cmd
.           7047    IN  NS  b.root-servers.net.
.           7047    IN  NS  e.root-servers.net.
.           7047    IN  NS  m.root-servers.net.
.           7047    IN  NS  i.root-servers.net.
.           7047    IN  NS  j.root-servers.net.
.           7047    IN  NS  c.root-servers.net.
.           7047    IN  NS  k.root-servers.net.
.           7047    IN  NS  g.root-servers.net.
.           7047    IN  NS  a.root-servers.net.
.           7047    IN  NS  f.root-servers.net.
.           7047    IN  NS  h.root-servers.net.
.           7047    IN  NS  d.root-servers.net.
.           7047    IN  NS  l.root-servers.net.
;; Received 811 bytes from 127.0.0.53#53(127.0.0.53) in 0 ms

;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for test.host.net.nz failed: network unreachable.
;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for test.host.net.nz failed: network unreachable.
;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for test.host.net.nz failed: network unreachable.
;; UDP setup with 2001:500:200::b#53(2001:500:200::b) for test.host.net.nz failed: network unreachable.
nz.         172800  IN  NS  ns3.dns.net.nz.
nz.         172800  IN  NS  ns7.dns.net.nz.
nz.         172800  IN  NS  ns5.dns.net.nz.
nz.         172800  IN  NS  ns1.dns.net.nz.
nz.         172800  IN  NS  ns2.dns.net.nz.
nz.         172800  IN  NS  ns4.dns.net.nz.
nz.         172800  IN  NS  ns6.dns.net.nz.
nz.         86400   IN  DS  13646 8 2 569B1BAE369FD18F03D088FBA91BD58A830E4E21D2C96155CED26754 4CAC14B1
nz.         86400   IN  DS  63529 8 2 65C9663EACC1AD314058A5A7B127D409D144BBA9A58EC0B6A7F4F028 574DF47B
nz.         86400   IN  DS  49157 8 2 44628E9BF710B40D5A5B19087A119EAF2C0B5CED7E7BA4268F4FC35B EF14B1C0
nz.         86400   IN  RRSIG   DS 8 1 86400 20231006170000 20230923160000 11019 . Mo/4OJSg4zaXeJw0QMt4RwUqS2uXDlD0BFw4BvNSwomfVILPoH0JI6jC b/AgP4uQdyyR9DPO6iXBsBrOkOkp2BWIbMjyhfLmO8GRT/+cxfVKcp6B PVO2jdrKHHN0EBj3kFUUhcdU/ZMgki4wJpMmuhMJT9uPOYrEBZQsUN5E P0s8zCfoqoFY86SMJRs1S57bRGCpyKoN0kdc2kvxP1RfCUNRmcMhS67J 00Fqhv8M7VgBuL+GoF//OfHDK9txtrmEquJPqAXG3Y70Aj3b2kKUZtWe xFBUr+K3n+eADBRO1AlUEs2VC909KW553pZ+n7i0nr4y8RX/6Bz41/9t OJGyPw==
;; Received 950 bytes from 192.33.4.12#53(c.root-servers.net) in 272 ms

;; UDP setup with 2001:67c:1010:13::53#53(2001:67c:1010:13::53) for test.host.net.nz failed: network unreachable.
host.net.nz.        86400   IN  NS  dns2.networksavvy.org.
host.net.nz.        86400   IN  NS  dns1.networksavvy.org.
host.net.nz.        86400   IN  NS  dns1.host.net.nz.
host.net.nz.        86400   IN  NS  dns2.host.net.nz.
ftq1sc65oboavpm01b73vht98aj0j7s4.net.nz. 3600 IN NSEC3 1 1 5 A28B2E20D85645FC FUJ14F0PIO5AL96LCFM2L3JH1E7UTRTM NS SOA RRSIG DNSKEY NSEC3PARAM
ftq1sc65oboavpm01b73vht98aj0j7s4.net.nz. 3600 IN RRSIG NSEC3 8 3 3600 20230929233149 20230923151828 55531 net.nz. GfoNDCz/ybU9LbfNzTf9knywysakZv6SL4hUVllv5OPXQyv3iPtKZdOg hngu+PyeSrfMlfDGuLTNQk3kOqS+iGGXZMpnFSdZweHevtJgY8Whqzz0 YP1R1p8XakEJ997RGf2IePCRBp9ZgLNeg+wC3PLOjW3tPXeWAkuT8+Pi V+Q=
9ct1bpg4b0gddtpcq1pburmco2sepqf4.net.nz. 3600 IN NSEC3 1 1 5 A28B2E20D85645FC 9JCPVKID50C1OU9KTMJ30RA7SMV8P01M NS DS RRSIG
9ct1bpg4b0gddtpcq1pburmco2sepqf4.net.nz. 3600 IN RRSIG NSEC3 8 3 3600 20230929191943 20230924034536 55531 net.nz. VpOzawDkNFCy+pPyM3qE0m4/B1yN/vVgQNYM4yoKdIOEayj3wF8J8UVv 1z9vOK1lOORCe1Jg3cJ+ysocogqdV9ER1mCTuvp3PqXmWP1eSOpXYqBj O6ez6mR2wHTkk8mbXO0mD1y1MicNnSHCu2dRBVWJr06slE/SDtjCh/XM 6fk=
;; Received 710 bytes from 194.146.106.54#53(ns7.dns.net.nz) in 72 ms

test.host.net.nz.   60  IN  NS  dns2.networksavvy.org.
test.host.net.nz.   60  IN  NS  dns1.host.net.nz.
;; Received 115 bytes from 169.197.131.74#53(dns1.networksavvy.org) in 168 ms

test.host.net.nz.   60  IN  NS  dns2.networksavvy.org.
test.host.net.nz.   60  IN  NS  dns1.host.net.nz.
;; BAD (HORIZONTAL) REFERRAL
;; Received 115 bytes from 60.234.77.241#53(dns1.host.net.nz) in 4 ms

test.host.net.nz.   3600    IN  A   60.234.77.236
;; Received 61 bytes from 77.68.75.47#53(dns2.networksavvy.org) in 332 ms

You referred to the ns for test.host.net.nz at dns2.networksavvy.org. while querying dns1.host.net.nz, that's the magic part right? — The AFOH, Sep 24 at 17:18
I dont understand your comment. The "magic" is putting NS records for test.host.net.nz into the zone file for host.net.nz (the NS revords cpuld have pointed to any server with a zone file containimg the zone file for test.host.net.nz - but I only have 1 set of nameservers, so I used what I have). — davidgo, Sep 24 at 18:38
I mean, when you queried ns7.dns.net.nz for a ns record on host.net.nz, it pointed to dns1 and dns2.networksavvy.org, and apparently dns2.networksavvy.org was an authoritative ns for test.host.net.nz despite being located completely outside of its domain, so that proves it right? — The AFOH, Sep 24 at 19:13
yes (but I did not query ns7.dns.net.nz - that is what "dig" worked out it needed to do and shows how recursive DNS works) — davidgo, Sep 24 at 19:19
I can see that your way of referring to an ns outside your domain led to a BAD (HORIZONTAL) REFERRAL code in dig, but it still works right? — The AFOH, Sep 25 at 0:56

Stack Exchange Network

Is it possible to have a DNS NS record point to a domain from outside the queried nameserver's domain?

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
networking
dns
nameserver
.

Hot Network Questions

Is it possible to have a DNS NS record point to a domain from outside the queried nameserver's domain?

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged networkingdnsnameserver.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
networking
dns
nameserver
.