Follow-up to #64 (part of #61).
The nameserver assessor was scoped to detect parent/child NS-set consistency (lame delegation: the child zone serves an NS the parent doesn't delegate, or vice-versa). This was deferred because of an infrastructure gap.
The gap
gecko collects NS records via a recursive query against the configured resolver for the domain's own name (ResolveDomainWorker, enumerate_jobs.go), which yields the child/authoritative apex NS set. Detecting lame delegation requires also knowing the parent's delegation NS set, which means querying the parent (TLD) nameservers non-recursively — a capability the dnsclient.Resolver interface does not expose today.
Scope
- Add a non-recursive "delegation lookup" to
internal/dnsclient (query the parent zone's authoritative servers, read the NS RRset from the AUTHORITY section).
- Compare parent-delegated vs child-authoritative NS sets in the assessor; emit an
ns_configuration_findings finding (e.g. lame_delegation / parent_child_mismatch) on divergence.
Follow-up to #64 (part of #61).
The nameserver assessor was scoped to detect parent/child NS-set consistency (lame delegation: the child zone serves an NS the parent doesn't delegate, or vice-versa). This was deferred because of an infrastructure gap.
The gap
gecko collects NS records via a recursive query against the configured resolver for the domain's own name (
ResolveDomainWorker,enumerate_jobs.go), which yields the child/authoritative apex NS set. Detecting lame delegation requires also knowing the parent's delegation NS set, which means querying the parent (TLD) nameservers non-recursively — a capability thednsclient.Resolverinterface does not expose today.Scope
internal/dnsclient(query the parent zone's authoritative servers, read the NS RRset from the AUTHORITY section).ns_configuration_findingsfinding (e.g.lame_delegation/parent_child_mismatch) on divergence.