## page was renamed from DNS/返答/delegation ## page was renamed from DNS/1/返答/delegation == delegation 返答 == <> <> <> 返答の[[DNS/RFC/1035/4|形式]] DNS/RFC/1035/4 [[/DJB]] 5つのDNS返答： http://djbdns.qmail.jp/djbdns/notes/type.html には {{{ RCODE NOERRORの返答; authority section に NS レコードが含まれていて SOA レコードは含まれていないとき }}} とある。さらに、以下の状況だと考えられる。 * header中のAA flag は０, Answer Section は空である。 * Authority SectionのNSレコードのラベルは問い合せ名の真のsuffixである。 これらをすべて満足していても、毒（偽返答）である可能性がある。NSを問い合せしなおすなどの対策が望ましい。 -- ToshinoriMaeno <> [[DNS/1/資源レコード/NS/出現場所]] [[DNS/返答/返答中のNS]] [[/返答中のRR_order]] == delegation == delegation と [[../referral]] を混同したような記述もある。 {{{ %grep -2 -n delegate rfc1034.txt 1030- 1031-The class partition is simple. The database for any class is organized, 1032:delegated, and maintained separately from all other classes. Since, by 1033-convention, the name spaces are the same for all classes, the separate 1034-classes can be thought of as an array of parallel namespace trees. Note -- 1065-a subtree. Once an organization controls its own zone it can 1066-unilaterally change the data in the zone, grow new tree sections 1067:connected to the zone, delete existing nodes, or delegate new subzones 1068-under its zone. 1069- -- 1082- as part of the authoritative data). 1083- 1084: - Data that describes delegated subzones, i.e., cuts around the 1085- bottom of the zone. 1086- -- 2945- 2946- Describes the registration policies used by the NIC to 2947: administer the top level domains and delegate subzones. }}} {{{ %grep -2 -n delegation rfc1034.txt ~ 1069- 1070-If the organization has substructure, it may want to make further 1071:internal partitions to achieve nested delegations of name space control. 1072-In some cases, such divisions are made purely to make database 1073-maintenance more convenient. -- 1140-When some organization wants to control its own domain, the first step 1141-is to identify the proper parent zone, and get the parent zone's owners 1142:to agree to the delegation of control. While there are no particular 1143-technical constraints dealing with where in the tree this can be done, 1144-there are some administrative groupings discussed in [RFC-1032] which -- 1160-using limited transatlantic bandwidth. 1161- 1162:As the last installation step, the delegation NS RRs and glue RRs 1163:necessary to make the delegation effective should be added to the parent 1164-zone. The administrators of both zones should insure that the NS and 1165-glue RRs which mark both sides of the cut are consistent and remain so. -- 1354- 4. Start matching down in the cache. If QNAME is found in the 1355- cache, copy all RRs attached to it that match QTYPE into the 1356: answer section. If there was no delegation from 1357- authoritative data, look for the best one from the cache, and 1358- put it in the authority section. Go to step 6. -- 1404-Wildcard RRs do not apply: 1405- 1406: - When the query is in another zone. That is, delegation cancels 1407- the wildcard defaults. 1408- -- 1864- the client. 1865- 1866: b. if the response contains a better delegation to other 1867: servers, cache the delegation information, and go to 1868- step 2. 1869- -- 1964-greater than zero. 1965- 1966:If the response shows a delegation, the resolver should check to see 1967:that the delegation is "closer" to the answer than the servers in SLIST 1968-are. This can be done by comparing the match count in SLIST with that 1969:computed from SNAME and the NS RRs in the delegation. If not, the reply 1970:is bogus and should be ignored. If the delegation is valid the NS 1971:delegation RRs and any address RRs for the servers should be cached. 1972-The name servers are entered in the SLIST, and the search is restarted. 1973- -- 2083-forces the TTL of all authoritative RRs to be at least the MINIMUM field 2084-of the SOA, here 86400 seconds, or one day. The NS RRs marking 2085:delegation of the MIL and EDU domains, together with the glue RRs for 2086-the servers host addresses, are not part of the authoritative data in 2087-the zone, and hence have explicit TTLs. -- 2667- 2668-The resolver would notice that the information in the response gave a 2669:closer delegation to ISI.EDU than its existing SLIST (since it matches 2670-three labels). The resolver would then cache the information in this 2671-response and use it to set up a new SLIST: }}} == SOA record == delegation返答にはSOAは現れないということの傍証 -- ToshinoriMaeno <> RFC 1034 {{{ The method is that a name server may add an SOA RR to the additional section of a response when that response is authoritative. The SOA must be that of the zone which was the source of the authoritative data in the answer section, or name error if applicable. The MINIMUM field of the SOA controls the length of time that the negative result may be cached. Note that in some circumstances, the answer section may contain multiple owner names. In this case, the SOA mechanism should only be used for the data which matches QNAME, which is the only authoritative data in this section. }}} <>