Looking for advice - Auditing zones on a set of name servers

Mailman List Mirror (Read Only)
1

Hi Everyone,

I'm looking for some advice here. I'm attempting to clean up a set of name
servers and have a list of domain names that should not actually be hosted
on those name servers. In some cases there are issues where there are
actually no NS records in a domain but it should be hosted on those name
servers. In some cases the name servers just aren't authoritative and the
domain should be removed. The name servers are all djbdns, not that it
matters a whole lot.

I'm wondering if anyone knows of some tools that I can use other than
homegrown ones that are a little more robust in terms of thinking of every
little possible issue for or against a domain than I can think of. Of a
list of domains that I marked for deletion some of them simply had little
problems but should not be deleted (rather just have their NS records
fixed). I also don't' want to pound on someone else's recursive name
servers or even the root name servers trying to audit ours since that's not
very nice. If anything I guess I could spread out the queries if I had the
right tools.

I wrote a quick script that looks up the NS records for a zone, then the A
records for those NS records and checks the resulting IP addresses against
a list of IP addresses that are our name servers. It's not quite doing all
I need it to do since sometimes we are authoritative but there are no NS
records or they are wrong. I'm also not sure beating on google's name
servers is a good idea either so you should fill in your OWN recursive name
servers instead f 8.8.8.8 and 8.8.4.4.

Thanks for reading! :smiley:

#!/usr/bin/perl
# No warranty or guarantee of fitness for any purpose or use. Do not use
# if you don't know what it does.

2

I'm looking for some advice here. I'm attempting to clean up a set of name
servers and have a list of domain names that should not actually be hosted
on those name servers. In some cases there are issues where there are
actually no NS records in a domain but it should be hosted on those name
servers. In some cases the name servers just aren't authoritative and the
domain should be removed. The name servers are all djbdns, not that it
matters a whole lot.

<snip>

I wrote a quick script that looks up the NS records for a zone, then the A
records for those NS records and checks the resulting IP addresses against
a list of IP addresses that are our name servers. It's not quite doing all
I need it to do since sometimes we are authoritative but there are no NS
records or they are wrong. I'm also not sure beating on google's name
servers is a good idea either so you should fill in your OWN recursive name
servers instead f 8.8.8.8 and 8.8.4.4.

don't you really want to walk the tree from . down? so dig +trace | machine-ify
then make sure that the criteria you care about work out properly?
(this avoides people's old/legacy/super-long-ttl causing problems in
the shorter term)

-chris

3

You could try ValiDNS (http://www.validns.net) which I am told does this sort of thing.

Jonathon

4

..snip..

> I need it to do since sometimes we are authoritative but there are no NS
> records or they are wrong. I'm also not sure beating on google's name
> servers is a good idea either so you should fill in your OWN recursive
name
> servers instead f 8.8.8.8 and 8.8.4.4.

don't you really want to walk the tree from . down? so dig +trace |
machine-ify
then make sure that the criteria you care about work out properly?
(this avoides people's old/legacy/super-long-ttl causing problems in
the shorter term)

I've done it this way. Another person wrote me off list and said the same
thing so I've modified things to do it this way and it looks good.

Thanks for your reply!