DNS is Still Lame

The talk opens with the basics of DNS delegation. A lame delegation happens when a name server is handed control of a zone but cannot give an authoritative answer for it. Such faults can stay hidden for a long time: a domain may keep resolving through its healthy servers while a broken one remains in its set. If the address behind that broken server is unused, someone else could claim it and take over part of the zone's queries.

The speaker then explains that every name server is itself a domain with its own name servers, which creates dependency trees that can reach dozens of links. Glue records shorten much of this chain, but a fault several levels away can still affect a domain. Walking the resolution process by hand shows how one timed-out server changes the outcome depending on which server a resolver picks. The speaker then demonstrates an open-source tool that checks every possible path through the tree instead of stopping at the first valid answer. It flags lame delegations, unexpected answers, and authoritative servers that disagree. Scans of random domains and country-code TLDs turned up many problems, mostly in ccTLDs.

The practical takeaways are to keep DNS dependency trees small, check them automatically, and report faults upstream when they sit outside your own control. The speaker also notes that registry operators varied widely in how they responded to reports, which may matter when choosing where to host a domain.