Right now, the DNS packet scanning does the following:
- It looks at the AN (answer) section of the DNS reply. Anything that is not either a direct answer to our query or part of a CNAME chain leading up to our answer is marked “RRX_IGNORE”.
- If there are any records in the AN section of the DNS reply, we mark as “RRX_IGNORE” all records in the NS and AR section of the DNS reply
- If there is no answer (AN) section, we look at the NS and AR sections
- We verify that all NS records are in-Bailiwick (as described in previous blog entries)
- We then look at records in the AR (glue records) section; any IPv4 and IPv6 records are compared to NS referrals in the NS section; if a given glue record corresponds to a NS record, we mark the glue record as “Glue for NS record number X”, where X is a number from 1 to 16 (we only support the first 16 NS records), and note that the NS record in question has IPv4 or IPv6 glue
- At this point, all NS records are marked as being either out of bailiwick, glueless, with only IPv4 glue, with only IPv6 glue, or with both IPv4 and IPv6 glue
Timeline: I’m getting married Friday, guys.