Understanding 'No Reachable Authority' Delegation in DNS

Introduction

In the domain name system (DNS), delegation is the process of distributing the responsibility of managing a particular label in the domain name hierarchy. This mechanism enables efficient and scalable management of large domains. However, there are instances when DNS delegation might fail, resulting in various issues. One such issue is the No Reachable Authority Delegation error. In this article, we will discuss the concept of No Reachable Authority Delegation, its causes, and potential solutions.

DNS Delegation

DNS delegation is the process of assigning a subdomain to another name server. The delegating name server (also called the parent name server) provides the IP address of the authoritative name server for the subdomain to the querying name server. The authoritative name server, in turn, responds to queries for the subdomain with the relevant resource records (RRs).

No Reachable Authority Delegation

No Reachable Authority Delegation (NRAD) is a condition that occurs when a name server cannot locate the authoritative name server for a particular subdomain. This can happen due to various reasons, such as:

• Network connectivity issues between the querying name server and the authoritative name server.
• DNS server misconfiguration.
• DNS caching issues.
• DNS propagation delays.

When a name server encounters NRAD, it returns a "NXDOMAIN" error to the querying name server. This error indicates that the queried domain name does not exist. However, in the case of NRAD, the domain name does exist, but the authoritative name server cannot be reached.

Example: No Reachable Authority Delegation with OVH

Let's consider an example where we want to delegate the subdomain home.example.com to a name server served by OVH. The domain example.com is registered with another registrar, and its MX records are served correctly by its DNS servers.

 $ dig example.com MX
 ;; ANSWER SECTION:
 example.com. 86400 IN MX 10 mail.example.net.
 example.com. 86400 IN MX 20 backup-mail.example.net.
 
 

To delegate home.example.com, we need to create a DNS record at the parent domain pointing to the IP address of the authoritative name server for home.example.com. Let's assume that the IP address of the authoritative name server is 1.2.3.4.

 $ dig example.com NS home.
 ;; ANSWER SECTION:
 example.com. 86400 IN NS ns1.example.net.
 example.com. 86400 IN NS ns2.example.net.
 home.example.com. 172800 IN NS ns1.ovh.net.
 home.example.com. 172800 IN NS ns2.ovh.net.
 
 

Now, when we query for the MX records of home.example.com, we should get the following output:

 $ dig home.example.com MX
 ;; ANSWER SECTION:
 home.example.com. 172800 IN MX 10 mail.home.example.com.
 home.example.com. 172800 IN MX 20 backup-mail.home.example.com.
 
 

However, if the authoritative name servers for home.example.com are not reachable, the querying name server will return a "NXDOMAIN" error:

 $ dig home.example.com MX
 ;; ANSWER SECTION:
 ;; query time: 101 msec
 ;; serial 172800
 ;; msg id 2
 ;; rrset rrset: MX, priority: 0, weight: 0, type: MX, class: IN
 ;; MSGSIZE  rcvd: 106
 ;; QUESTION SECTION:
 ;home.example.com. IN MX
 ;; ANSWER SECTION:
 home.example.com. 172800 IN NXDOMAIN
 
 

Solutions for No Reachable Authority Delegation

There are several potential solutions for No Reachable Authority Delegation:

• Check network connectivity between the querying name server and the authoritative name server.
• Check DNS server configuration for any errors or misconfigurations.
• Clear DNS caches on the querying name server and the authoritative name server.
• Wait for DNS propagation delays to resolve.
• Consider using secondary name servers or multiple authoritative name servers to improve redundancy and availability.