Tag Archive | Dig

Same dig queries for Download.microsoft.com with different results

Oct10

DiG 9.9.2:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
C:>dig download.microsoft.com @ns1.msft.net
 
; <<>> DiG 9.9.2 <<>> download.microsoft.com @ns1.msft.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 46932
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
 
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;download.microsoft.com.                IN      A
 
;; Query time: 78 msec
;; SERVER: 2a01:111:2005::1:1#53(2a01:111:2005::1:1)
;; WHEN: Wed Oct 10 03:49:59 2012
;; MSG SIZE  rcvd: 51

DiG 9.3.2:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
C:>dig download.microsoft.com @ns1.msft.net
 
; <<>> DiG 9.3.2 <<>> download.microsoft.com @ns1.msft.net
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1780
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
 
;; QUESTION SECTION:
;download.microsoft.com.                IN      A
 
;; ANSWER SECTION:
download.microsoft.com. 0       IN      CNAME   download.microsoft.com.nsatc.net.
 
;; Query time: 93 msec
;; SERVER: 65.55.37.62#53(65.55.37.62)
;; WHEN: Wed Oct 10 03:51:41 2012
;; MSG SIZE  rcvd: 86

Dig command to test if DNSSEC is working

Oct4

When performing the following dig query, if you get SERVFAIL, then you know DNSSEC validation is working the way it should.

root@ubuntu:~# dig www.dnssec-failed.org @localhost

; <<>> DiG 9.9.1-P3 <<>> www.dnssec-failed.org @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53418
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A

;; Query time: 47 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Oct 4 02:59:20 2012
;; MSG SIZE rcvd: 50

However, if you get NOERROR then something has gone wrong and DNSSEC validation is not working the way it should.

root@ubuntu:~# dig www.dnssec-failed.org @8.8.8.8

; <<>> DiG 9.9.1-P3 <<>> www.dnssec-failed.org @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43692
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A

;; ANSWER SECTION:
www.dnssec-failed.org. 4750 IN A 69.252.216.215
www.dnssec-failed.org. 4750 IN A 69.252.208.135

;; Query time: 38 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 4 03:00:45 2012
;; MSG SIZE rcvd: 82