为什么 Google DNS 服务器没有为其自己的域返回权威答案？
我正在 Redhat Linux 5.1 下使用nslookupBind digDNS v4.9.7。
测试
/etc/resolv.conf：
nameserver 0
search home
/etc/named.boot：
...
options forward-only query-log
forwarders 192.168.1.1 203.12.160.35 203.12.160.36 203.12.160.37
...
查询“dns.google.com”的IP地址（使用我的DNS服务器）：
[root@r51 ~]$ date && nslookup dns.google.com
Sat Jan 13 22:34:31 EST 2024
Server: r51
Address: 0.0.0.0
Non-authoritative answer:
Name: dns.google.com
Addresses: 8.8.4.4, 8.8.8.8
[root@r51 ~]$
[root@r51 ~]$ date && dig dns.google.com
Sat Jan 13 22:36:15 EST 2024
; <<>> DiG 2.2 <<>> dns.google.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
;; flags: qr rd ra; Ques: 1, Ans: 2, Auth: 0, Addit: 0
;; QUESTIONS:
;; dns.google.com, type = A, class = IN
;; ANSWERS:
dns.google.com. 210 A 8.8.8.8
dns.google.com. 210 A 8.8.4.4
;; Total query time: 15 msec
;; FROM: r51 to SERVER: default -- 0.0.0.0
;; WHEN: Sat Jan 13 22:36:15 2024
;; MSG SIZE sent: 32 rcvd: 64
[root@r51 ~]$
查询“dns.google.com”的IP地址（使用“dns.google.com”）：
[root@r51 ~]$ date && nslookup dns.google.com 8.8.8.8
Sat Jan 13 22:36:20 EST 2024
Server: dns.google
Address: 8.8.8.8
Non-authoritative answer:
Name: dns.google.com
Addresses: 8.8.4.4, 8.8.8.8
[root@r51 ~]$
[root@r51 ~]$ date && dig @8.8.8.8 dns.google.com
Sat Jan 13 22:36:42 EST 2024
; <<>> DiG 2.2 <<>> @8.8.8.8 dns.google.com
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags: qr rd ra; Ques: 1, Ans: 2, Auth: 0, Addit: 0
;; QUESTIONS:
;; dns.google.com, type = A, class = IN
;; ANSWERS:
dns.google.com. 900 A 8.8.8.8
dns.google.com. 900 A 8.8.4.4
;; Total query time: 12 msec
;; FROM: r51 to SERVER: 8.8.8.8
;; WHEN: Sat Jan 13 22:36:42 2024
;; MSG SIZE sent: 32 rcvd: 64
[root@r51 ttya3 22:36:42 /]$
结果
预期（即针对 8.8.8.8 的查询）：
Auth: 1
实际的：
Non-authoritative answer
Auth: 0
答案1
感谢 @muru 的评论，它不起作用的原因是 8.8.8.8 和 8.8.4.4 (dns.google.com) 不是权威名称服务器。
可以通过查询域的 SOA 记录，然后使用原始名称服务器（记录中详细说明）作为后续 DNS 查询中的参考服务器来获取域的权威名称服务器：
nslookup -type=soa dns.google.com
dig soa dns.google.com
SOA 查询输出示例：
[root@r51 ~]$ nslookup -type=soa dns.google.com
Server: r51
Address: 0.0.0.0
Authoritative answers can be found from:
google.com
origin = ns1.google.com
mail addr = dns-admin.google.com
serial = 598133582
refresh = 900 (15 mins)
retry = 900 (15 mins)
expire = 1800 (30 mins)
minimum ttl = 60 (1 min)
[root@r51 ~]$
[root@r51 ~]$ dig soa dns.google.com
; <<>> DiG 2.2 <<>> soa dns.google.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
;; flags: qr rd ra; Ques: 1, Ans: 0, Auth: 1, Addit: 0
;; QUESTIONS:
;; dns.google.com, type = SOA, class = IN
;; AUTHORITY RECORDS:
google.com. 60 SOA ns1.google.com. dns-admin.google.com. (
597792727 ; serial
900 ; refresh (15 mins)
900 ; retry (15 mins)
1800 ; expire (30 mins)
60 ) ; minimum (1 min)
;; Total query time: 108 msec
;; FROM: r51 to SERVER: default -- 0.0.0.0
;; WHEN: Sun Dec 31 10:08:09 2023
;; MSG SIZE sent: 32 rcvd: 82
[root@r51 ~]$
上述 SOA 查询显示可以在“ns1.google.com”找到权威服务器。
查询“dns.google.com”的IP地址（使用权威名称服务器）：
[root@r51 ~]$ nslookup dns.google.com ns1.google.com
Server: ns1.google.com
Address: 216.239.32.10
Name: dns.google.com
Addresses: 8.8.4.4, 8.8.8.8
[root@r51 ~]$
[root@r51 ~]$ dig @ns1.google.com dns.google.com
; <<>> DiG 2.2 <<>> @ns1.google.com dns.google.com
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags: qr aa rd; Ques: 1, Ans: 2, Auth: 0, Addit: 0
;; QUESTIONS:
;; dns.google.com, type = A, class = IN
;; ANSWERS:
dns.google.com. 900 A 8.8.4.4
dns.google.com. 900 A 8.8.8.8
;; Total query time: 113 msec
;; FROM: r51 to SERVER: ns1.google.com 216.239.32.10
;; WHEN: Sat Jan 13 23:54:03 2024
;; MSG SIZE sent: 32 rcvd: 64
[root@r51 ~]$
如上所示，nslookup不再显示Non-authoritative answer在响应中。
至于dig输出，该Auth值（在本例中为Auth: 0）表示权威部分信息未打印（名称服务器可能未提供任何信息）。然而，权威标志/位实际上已设置（即aain flags: qr aa rd）。