iRead, iLearn, iWrite. Hence, iBlog.

For Indian Military, Nuclear & Space matters, visit:

Sunday, April 20, 2008

DNS Bajaj : Graphical representation of domain records delegation


20080420dnsbajaj00

DNS Bajaj (pronounced DNS by Eye) is an online service that generates a graphical representation of the propagation of Domain records of your site through the Name servers handling your DNS. As the name suggests, it allows you to view the delegation of your domain through the Name servers in a graphical manner and helps pinpoint any errors that may have occurred in setting up your DNS.


Type in the domain name you wish to check. A little while later, the service will produce an automatically generated image for you to analyse or just plain gawk at. The image shows you the servers that handle your query for accessing a particular site - right from the Root Nameserver to the Name servers handling your sites DNS. We will take a better look at the service by analyzing the result of a domain - mechworld.co.cc. (please note that though one need not put the "."to the right of cc, it is in fact assumed present and called the root domain and any query always passes through its servers)


This is the image result generated for the domain.


(click on the picture to view a larger sized image)
www.mechworld.co.cc


The query for mechworld.co.cc will start from the fastest accessible Root-server. In this case it turned out to be d.root-servers.net. The Root-server looks up its record database and finds the Name server handling queries for cc. domains. a5.nstld.com was found to be the fastest and easily accessible name servers handling cc. queries. The process is followed again, where this server looks through its records to locate the Nameserver handling co.cc. queries - ns1.co.cc and ns2.co.cc. Your query is forwarded accordingly. Once it reaches the co.cc. Nameservers, it would look through its records to see which DNS Nameservers you have entered to handle queries for your site - mechworld.co.cc.


In this case 5 Name servers have been used - ns1.us.editdns.net, ns2.us.editdns.net, ns3.us.editdns.net, ns1.eu.editdns.net and ns2.eu.editdns.net. It is shown accordingly in the graph depicted in the first rectangle.


The second rectangle, showing all my 5 Nameservers in it represents the communication of domain records that takes place between the servers. Since there are 5 Name Servers, in normal working condition all the 5 Namservers must communicate the records with the other 4. As a result, it is should be depicted by 4 arrows emerging from the diagram of each Name server and 4 terminating in it. However, as the circled arrow indicates, each of these Nameservers will have an arrow that emerges and terminates in itself. Thus there will be 5 arrows emerging from it and 5 terminating in it. Any Nameserver having this self-emerging and terminating arrow indicates that this Nameserver is authoritative of your domain name. For any Nameserver to be considered Authoritative, it must be entered in the Domain registrar’s control panel (explained later).


How can you put DNS Bajaj to some good use?


Take a look at this result image.


(click on the image to view a larger sized image)

www.online.co.cc


Recently I was trying to create a Primary-slave Nameserver setup for my blog. Before implementing it here I tried it out on a dummy blog that I created for testing. I had made EveryDNS as my primary domain and EditDNS as the secondary/slave domain. However even after a fairly long time after I had setup this thing, I found that the domain records were not being updated in EditDNS. So I ran this service for my domain name and sure enough it confirmed this error in delegation of records. None of the Secondary Nameservers - ns1.us.editdns.net and ns2.us.editdns.net, that I had entered in the co.cc control panel had my domain records. They were appropriately marked in red colored rhombus. But what actually enabled me to pinpoint the problem was the Nameserver ns4.everydns.net also being marked in red. This is of significance as the server in question also handles axfr queries (ns4.everydns.net = axfr.everydns.net = 64.158.219.3). This was confirmed when I tried to ping this server and was unsuccessful in it. I reported the matter and this was later confirmed by EveryDNS. Though I later ran a combination of ping and nslookup commands (dig, if you wish) to confirm this, using DNS Bajaj, IMHO, is a far more convenient and faster option for carrying out your initial diagnosis. You may even download and install the DNS Bajaj script on your own computer.


This is the blog’s setup of Nameservers and delegation of domain records.


(click on the image to view a larger sized image)

www.shubhspace.co.cc


Since the domain registrar - co.cc, allows account holders to enter only 5 Nameservers, the ones listed outside the second rectangle coud not be entered in the control panel and hence are not considered authoritative. At various points, I had entered the Nameservers currently outside in the domain registrar’s control panel and on each occasion they were depicted as Authoritative for the domain. However a Nameserver could be entered in the registrar’s control panel and still not be Authoritative. It all depends upon the way the Nameservers have been set up by its Administrators. The service can also show you all the subdomains associated with the domain name. However, this is a feature you can all but forget. No self-respecting Admin of a Nameserver will ever entertain zonetransfer requests from any Tom, Dick or Harry (ie, you).


The code for this service has been written by Bjorn Isaksson,which he has termed as a proof of concept. DNS Bajaj is a pearl script that uses Net::DNS module to query the domain’s Nameservers for the delegation and then forwards the result to Graphviz, developed by AT&T to generate the image.


The graphical representation of delegation of domain records of some popular sites


(click on the images to view a larger sized image)



<>
</><>
</> <>
</> <>
</> <>
</> <>
</> <>
</> <>
</> <>
</> <>
</> <>
</> <>
</> <>
</>

www.google.com


www.google.com


www.microsoft.com


www.af.mil


www.af.mil


www.yahoo.com


www.thinkdigit.com


www.infosys.com


www.sun.com


www.apple.com


www.apple.com


Please note that though this service depicts the delegation of your domain records, any query requesting your site need not always access the Nameservers handling your domain. The Internet is peppered with DNS servers that hold cache of your domain records. One of those may intercept your query and forward it to the requested hosting server, thereby saving time. To follow the actual path followed when you query a site, use tracert.


If you have any queries, suggestions or criticisms about this post, feel free to drop in a comment. I will definitely try to address the issue to the best of my ability.