Skip to content

Nameserver assessor: parent/child NS consistency (lame delegation) #84

Description

@danielmichaels

Follow-up to #64 (part of #61).

The nameserver assessor was scoped to detect parent/child NS-set consistency (lame delegation: the child zone serves an NS the parent doesn't delegate, or vice-versa). This was deferred because of an infrastructure gap.

The gap

gecko collects NS records via a recursive query against the configured resolver for the domain's own name (ResolveDomainWorker, enumerate_jobs.go), which yields the child/authoritative apex NS set. Detecting lame delegation requires also knowing the parent's delegation NS set, which means querying the parent (TLD) nameservers non-recursively — a capability the dnsclient.Resolver interface does not expose today.

Scope

  • Add a non-recursive "delegation lookup" to internal/dnsclient (query the parent zone's authoritative servers, read the NS RRset from the AUTHORITY section).
  • Compare parent-delegated vs child-authoritative NS sets in the assessor; emit an ns_configuration_findings finding (e.g. lame_delegation / parent_child_mismatch) on divergence.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    assessorAssess-phase judgment/findingsenhancementNew feature or request

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions