Hurricane Electric's IPv6 Tunnel Broker Forums

IPv6 Certification Program Topics => General Discussion => Topic started by: miloszgancarz on August 03, 2009, 12:52:39 PM

Title: IPv6 glue test impossible with afraid.org domains?
Post by: miloszgancarz on August 03, 2009, 12:52:39 PM
I've come to the conclusion that since IPv6 glue requires the registrar to add AAAA records for NS record names on the TLD server(s), getting past the IPv6 Sage test with a domain hosted on afraid.org is impossible. 

Servers ns*.afraid.org don't have any AAAA records and therefore the guru test query will never succeed. 

Am I correct in this sum-up? 

I'm referencing this thread to support my conclusion.
http://www.tunnelbroker.net/forums/index.php?topic=274.msg1402#msg1402

As such, an IPv6 Sage certification requires purchasing one's own domain from a registrar that provides IPv6 glue, or working with an existing domain environment setup with IPv6. 


thanks
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: kriteknetworks on August 03, 2009, 04:12:26 PM
Or moving the domain to a registrar that supports IPv6 glue, you can find a list in the FAQ section of http://www.sixxs.net
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: bpier on August 04, 2009, 07:15:48 AM
I used www.editdns.net.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 04, 2009, 12:27:07 PM
The service at freedns.afraid.org is NOT a domain registration service.  It is DNS.  These are separate things.

You are correct that since the DNS servers at afraid.org don't have IPv6 addresses, they cannot be used with the test.  However, they will serve IPv6 glue records.  Your conclusion is correct but the logic you used to arrive at the conclusion is faulty.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 07, 2009, 12:37:51 AM
Well, not quite. afraid.org cannot serve glue records, since it is not a registry. It can serve host records for name servers, yes. "A glue record is the IP address of a name server held at the domain name registry." See also http://faq.domainmonster.com/dns/glue_record/

More to the point, afraid.org can serve NS records, which lets you use your own out-of-bailiwick name server for one of the afraid.org subdomains. You can get through "Guru" with a combination of afraid.org, v6ns.org and a BIND server (or indeed powerdns) running on your local v6-enabled network.

To get "Sage", you need your own domain from a registrar that can set ipv6 glue with the registry. I used gkg - they support v6 glue right there in the web interface, which made it quite easy to set up. Alternatively, you can have someone who has their own domain with glue for their server set up a zone for you; that will work just as well.

This should also work if you started out with an afraid.org subdomain, by setting your new and shiny glue-enabled NS as an out-of-bailiwick NS on your afraid.org subdomain.

afaik, none of the free DNS services have ipv6-enabled name servers, never mind ipv6-enabled name servers with ipv6 glue. At least I was not able to find any. Hence the need to run your own server, or give a friend a beer and use his.

Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 07, 2009, 11:23:28 AM
You forget about freedns.afraid.org's ability to register subzones under zones it already hosts.  Those may have glue records.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 08, 2009, 02:42:50 AM
You forget about freedns.afraid.org's ability to register subzones under zones it already hosts.  Those may have glue records.

You'd think so - but their glue is moot, unless you can use their name servers too. Which would bring us back to the "beer" scenario.

Take a look at a glue service set up specifically for the Guru test: ns0.nic.v6ns.org has glue; that doesn't mean that ns1.sub.v6ns.org has glue. I can say with utter conviction (because I tried it) that you do need glue on your own NS to pass Sage, not just on the NS for the domain hosting your subdomain. To re-state, that means an AAAA entry at the registry of the TLD of your NS's FQDN.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: leenoux on August 08, 2009, 03:56:36 AM
you're right yorick,
unless afraid.org can serve NS records, which lets us use our own out-of-bailiwick name server(with ipv6 glue on tld registries) for one of the afraid.org subdomains.we cannot obtain sage using one of subdomain in afraid.org  :)
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 08, 2009, 06:05:18 AM
unless afraid.org can serve NS records, which lets us use our own out-of-bailiwick name server(with ipv6 glue on tld registries) for one of the afraid.org subdomains.

You are right, and they can. That's how I got sage without needing to reset the domain used for the tests. It doesn't buy you much - you still need an NS with glue that you control. It is a way to get to sage for the terminally stubborn - or you could mail ipv6@he.net, ask for a reset of your tests, and go with one of your own domains (with glue) from the very start.

I hate starting over, though. That's almost admitting defeat, that is.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 08, 2009, 04:35:55 PM
The problem isn't that afraid.org can't serve IPv6 glue.  It can and does.
The problem is that afraid.org itself doesn't have IPv6 glue leading to its in-zone name servers.

Those are DIFFERENT issues.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 08, 2009, 06:57:11 PM
The problem isn't that afraid.org can't serve IPv6 glue.  It can and does.

It can't serve TLD glue records, which is what the Sage test looks for. I haven't found a way that it could serve more pedestrian non-TLD glue records, either, but that's neither here nor there for the sage test.

Put a more technical way: Say you have a .com domain at afraid.org - yorick.mooo.com, why not. And your nameserver is ns1.yorick.mooo.com. What the Sage test looks for is an answer to "dig ns1.yorick.mooo.com AAAA @a.gtld-servers.net", essentially - a AAAA record for your nameserver held at the registry for the TLD. That is TLD glue, and afraid.org certainly can't provide it. Not with AAAA nor with A.

A more "pedestrian" glue might be to set an NS record at afraid.org for yorick.mooo.com pointing to ns1.yorick.mooo.com, and then have an A (or AAAA) entry at the mooo.com level for ns1.yorick.mooo.com, so it can be found. I don't see a way to do that in afraid.org, either, but maybe I'm missing something in the web interface. Even if that is possible - and if so, I'd love to learn how it's done in their interface - that's still not TLD glue, and won't get you through Sage.

Whether afraid.org's servers are reachable over AAAA is rather beside the point. The glue has to be at TLD level for this test; the afraid.org name servers would never get involved in the query, anyway, if TLD glue could be provided.

To be fair, this is not afraid.org's fault in the least. I'm not even sure a subdomain service like this _can_ get TLD glue entered for all those subdomains. I can see the operators of the TLD registry objecting to such an idea.

The discussion really is only about "what is TLD glue", and "how do you get it", and possibly "and then how can you complete Sage on the afraid.org subdomain you started out with, once you have TLD glue" - not about "whose fault is this" (nobody's, truly) or "rabble rabble afraid.org should" (they should be given lots of beer for providing an awesome and free service).
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: dielaughing on August 09, 2009, 01:27:23 AM
This is one of those things that makes me angry because it wastes my time. IF IT IS IMPOSSIBLE TO USE AFRAID.ORG YOU NEED TO STATE THAT IN BIG FREAKING WORDS ON YOUR HOME PAGE! Otherwise you are real jerks wasting lots of people's time. Time to chalk he.net as another horribly stupid site with an eye bleeding design. Your language is vague, your directions are incomplete, and you are underhandedly biasing people against IPv6. TRY AND MAKE IT MORE DIFFICULT, WHY DON'T YOU. I mean, sheesh, life is hard enough without unnecessarily complicating things. EPIC FAILURE. >:(
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: broquea on August 09, 2009, 02:49:18 AM
IPv6 Glue is submitted at the registrar level either by creating NS host records with IPv6 addresses or setting other NS authoritative with existing IPv6 Glue, for your domain. If your TLD doesn't support glue, you can use another NS in a different domain as 'out of bailiwick', as long as that NS you are using has had glue configured with their registrar.

Afraid.org isn't our responsibility or service, nor are we aware of how they've configured the availability of their services. I personally happen to have only known of their free reverse DNS for IPv6 allocations service, which is commendable and works quite well.

We've provided no walk-though on how to complete from Newbie through Sage, except for a handful of various software configuration examples, and a general idea on what each level tests for. There is no goal achieved in spoon-feeding answers. The better goal is to get people thinking and looking at their various services and learn how to get them up and running on IPv6. Answers can and will be found by researching online, as well as asking the community or even us directly.

I would say, in contrast to the comment about creating a bias against learning about IPv6, that the almost 7,000 users (as of this post) that have decided to try the free online certification program seem inclined to want to learn something more about IPv6.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: leenoux on August 09, 2009, 03:23:40 AM
well, like old wise man said "no pain, no gain"  ;)
honestly, in my experiences with ipv6, he.net/tunnelbrokers.net do the excelent job/service for me.
their staffs are very responsive, eventhough this service is without SLA.

my knowledges is getting better and better dealing with ipv6 stuffs, configuring daemons(smtp,pop3,dns,http), routing  etc..

thanks to he.net and their staffs  :)
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 09, 2009, 03:53:03 AM
dielaughing: Really, now? When I started, I only had the vaguest idea what "glue" was. "Bailiwick" sounded like something out of a Dickensian novel. All that time-wasting and googling and head-scratching, getting to Guru only to be stuck at Sage again, pondering the relative merits of "feed a friend some beer and have him take care of it" vs. "get my own domain and really see what setting up glue looks like" - I had a blast!

So, yeah - if taking part in such a fun, hands-on learning exercise gets your blood roiling so badly, then it may be time to move on. Or, alternatively and preferably, you could step back a few steps, take a deep breath, and treat this as the excellent teaching tool it is. The clues on how to finish the test are so thick in this post, they may amount to violating HE's "no step-by-step walkthrough" rule.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: jimb on August 09, 2009, 04:05:24 AM
This is one of those things that makes me angry because it wastes my time. IF IT IS IMPOSSIBLE TO USE AFRAID.ORG YOU NEED TO STATE THAT IN BIG FREAKING WORDS ON YOUR HOME PAGE! Otherwise you are real jerks wasting lots of people's time. Time to chalk he.net as another horribly stupid site with an eye bleeding design. Your language is vague, your directions are incomplete, and you are underhandedly biasing people against IPv6. TRY AND MAKE IT MORE DIFFICULT, WHY DON'T YOU. I mean, sheesh, life is hard enough without unnecessarily complicating things. EPIC FAILURE. >:(
IMHO, I'm grateful that HE is providing the tunnels, this forum, and the certification tests, which are both very useful, fun, and do I even need to mention, free?

Part of the fun of doing the certification is actually learning about IPv6 and configuring and operating services in a v6 environment.  It's not HE's place to handhold people through the process.  I suggest you google "DNS glue records" and try to understand what it means. 

Do you really expect HE to provide some sort of list of registrars that support v6 glue?  It would be ridiculous to ask them.  And it's not their job, it's yours.  Google is your friend here too.  (suggestion: godaddy supports it, at least under the .cc TLD, others?  Find out!  Do your homework!)  Perhaps there should be a sticky thread listing these to help out a bit (if there isn't one already), but HE should have no obligation to come up with the list themselves.

Honestly, the cert process shouldn't be very difficult to anyone with a bit of systems and/or network administration experience.  Most things, particularly DNS glue, work the same way it does under IPv4.  So it should be familiar.  For "curious users" or students, well, there's obviously a learning curve.  But that's sort of the point, isn't it?  Google, wikipedia, etc, etc, are there for you.

I realize that your post was probably made whilst experiencing immense frustration, but a post like yours isn't just looking a gift-horse in the mouth, it's kicking it.  Perhaps you should take after your nick a bit more, and not take this stuff quite so seriously?
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: dielaughing on August 09, 2009, 05:03:09 AM
Your requirements are false, your use of terms like "end point" only serves to create useless, redundant, and confusing jargon, and I ALREADY KNOW EVERYTHING ABOUT IPv6! I'm flat out calling your methods frustratingly retarded. I'm not angry because I don't understand. I'm angry because you are calling your stupid tutorial quiz a "certification test". While it might be great for noobs, you site design is so bad, so thoroughly counterintuitive, that it just pisses me off. Taking you at your word, following the requirements, will not suffice to complete the exam. Go back and read the "All you need" part and contrast that with the actual records you are trying to retrieve. Ah ha! Maybe you should point out either exactly what you seek, or fix the tragic clusterf**k that is your site design and requirement information. I know you won't because this is just a giant social engineering experiment to scrape a bunch of info from the witless masses. You get that when they sign up. You don't need them to complete it. That would only cost you money. You have a financial interest in keeping it as f**king lame as it is now.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: jimb on August 09, 2009, 05:24:48 AM
 :o  OK.  This has got to be a troll.

Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: broquea on August 09, 2009, 09:56:50 AM
If you have any positive constructive criticism now is the time to share. We're always more than happy to listen to suggestions and work to implement changes for the better. Also if you need help getting beyond Explorer (http://ipv6.he.net/certification/scoresheet.php?pass_name=dielaughing), please feel free to ask for help or advice. We're absolutely willing to help anyone that is stuck, especially those that know everything about IPv6 like configuring web-servers. In point, we're also working on some presentations (video, and not outright walk-throughs) about the certification program that will contain some explanation about each level, and how to progress.

If you are truly this upset and reconciliation appears impossible, and would like to no longer participate in the certification program and tunnelbroker.net, you can ask us to close out the account and remove all personal information. We will honor such a request. If this is just honest to goodness trolling, then I don't feel a need to continue this discussion, and won't.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: dataless on August 09, 2009, 09:58:27 AM
Your requirements are false, your use of terms like "end point" only serves to create useless, redundant, and confusing jargon, and I ALREADY KNOW EVERYTHING ABOUT IPv6! I'm flat out calling your methods frustratingly retarded. I'm not angry because I don't understand. I'm angry because you are calling your stupid tutorial quiz a "certification test". While it might be great for noobs, you site design is so bad, so thoroughly counterintuitive, that it just pisses me off. Taking you at your word, following the requirements, will not suffice to complete the exam. Go back and read the "All you need" part and contrast that with the actual records you are trying to retrieve. Ah ha! Maybe you should point out either exactly what you seek, or fix the tragic clusterf**k that is your site design and requirement information. I know you won't because this is just a giant social engineering experiment to scrape a bunch of info from the witless masses. You get that when they sign up. You don't need them to complete it. That would only cost you money. You have a financial interest in keeping it as f**king lame as it is now.

Wow, you need to try and relax some...

The "Certification" is an unofficial process where people can basically prove to themselves they understand and can work with IPv6 technology.  To complete the tests you need to be able to complete a number of tasks, one of them is the test you seem to be so upset about.  The test is not there to make you mad, it's there to help you understand more about IPv6.  If your registrar doesn't support IPv6 glue contact them and ask them to add support.  Do some research on IPv6 glue and see who does and does not support it.

Like any type of training or certification HE seeks to help people understand IPv6 from top to bottom and encourage the growth of the system.  You say you fully understand IPv6, that's great.  Not everyone does when they first get here and they can learn a lot from the system.  The certification isn't going to get you an extra 10k a year at your job or anything, so why stress it?

Is this site the most interesting looking one I have ever seen?  No, not even close.  But it is very functional and fast.  It gets the job done, I'm glad they didn't spend all the time and effort on making it pretty and worked on it's functionality instead.  I have yet to find another Tunnel Broker in the US that allows you to create an account and setup a tunnel in under 5 minutes.  But not all services are for all people, nobody is forcing you to use HE, if you do not like them then do not use them.

HE has the ability to get a lot of useful data from their IPv6 tunnel system.  Take for example the daily tests where people send in traceroutes, pings and other information.  It bumps your cert numbers but more importantly for them it helps them log valuable data about their network.  What other providers do and do not have IPv6 support, how well does HE's peering allow access to networks around the world, what kind of speeds do you get around the world, etc. It's a win win system, I as the user of HE's tunnel service learn how to work with IPv6 and they improve their network at the same time.

How much money do you think HE spends on these free services they provide us?  Don't you think they are due something in return?  I salute HE and any Tunnel Broker for helping the Internet community test and grow the IPv6 system.  It's enthusiast that made the Internet what it is today, and that very same type of person is what is needed to drive IPv6 expansion.

The bottom line is HE is doing this on their dime, they are spending resources on something to try and help people understand and expand IPv6.  If the hand out isn't up to your standards, go look for someone else to spend their money to give you something for free the way you want to receive it.  When you spend your money for a service like this then you can complain about it.  Until that day comes either accept the free service or move on, there is no need to bash HE or any other service provider because your registrar isn't up to par.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 09, 2009, 12:07:33 PM
I don't see how a domain under the .COM TLD would have glue records for afraid.org (since the latter is under the .ORG TLD).  PIR does implement IPv6 glue in the .ORG TLD.

Being IPv6 reachable and having IPv6 glue are separate things.

If you want an IPv6 reachable free DNS service in .ORG, try Xname.  Its "ns2" has IPv6 glue.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: leenoux on August 09, 2009, 06:05:03 PM
that's true, .com TLD cannot have glue record for *.afraid.org or any sub.domain.org.
in my real practise i cannot add out-of-zone ns with host(a/aaaa) record on registrar.but i can add them as authoritative ns.
*.afraid.org is just  a zones, any NS on different TLD(with ipv6 glue on its own zone) can be authoritative for *.afraid.org zones.

CMIIW

Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 10, 2009, 06:53:24 AM
Being IPv6 reachable and having IPv6 glue are separate things.

Yes.

I don't see how a domain under the .COM TLD would have glue records for afraid.org (since the latter is under the .ORG TLD).  PIR does implement IPv6 glue in the .ORG TLD.

Well, I feel like a broken record at this point, so I'll just point these out - some fiddling and hitting the "Sage" test button will show you what I'm talking about:

- Think out-of-bailiwick - think NS record on your subdomain - you're not going to use the afraid.org name servers for anything but delivering your NS record. What matters is what .TLD your NS is under, since that's where the Sage test does its glue checking.
- I finished Sage on this account with yorick.mooo.com (hosted by afraid.org) and an out-of-bailiwick NS on a .com I own. I tried finishing it with an out-of-bailiwick subdomain on v6ns.org, but that failed because of lack of glue.

Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 10, 2009, 01:18:49 PM
Quote
I tried finishing it with an out-of-bailiwick subdomain on v6ns.org, but that failed because of lack of glue.
There shouldn't be any glue as your domain is a .com and your name servers are .org.

Glue isn't merely an additional record that provides an address for a name server.  Glue is the provision of an address for a name server that exists in the ZONE it is serving that would be unreachable if it weren't for the glue record itself.

Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: jimb on August 10, 2009, 04:43:36 PM
I noticed a few people mentioned on here that the glue records are kept on registrar's name servers for a given TLD.

I've always been under the impression that the registrars just submitted these host/glue records to whoever actually maintained the master name servers for a particular TLD via a back channel/process of some type.  Then they'd be distributed via normal DNS processes or whatever.

Is this a false impression?  Perhaps the registrars themselves all run servers for the TLDs they participate in, in a distributed fashion, and have some process whereby the can all enter the glue and domains, etc, into the TLD zone master servers? 

I guess I'm curious how things work at that level.  Of course it could also vary by TLD.

Also, nostalgia:  anyone remember the times when one would have to submit new domain requests and/or host record requests to NIC.DDN.MIL or hostmaster@internic.net via emailed templates?  :P
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 11, 2009, 03:59:05 AM
I noticed a few people mentioned on here that the glue records are kept on registrar's name servers for a given TLD.

I've always been under the impression that the registrars just submitted these host/glue records to whoever actually maintained the master name servers for a particular TLD via a back channel/process of some type.  Then they'd be distributed via normal DNS processes or whatever.

Kept on the registry's, not registrar's, name servers for a given TLD.

So, yes, you are right: Glue is a host record for your NS kept by "whoever maintains the authoritative name servers for a particular TLD" - the registry for that TLD.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 11, 2009, 04:07:23 AM
Quote
I tried finishing it with an out-of-bailiwick subdomain on v6ns.org, but that failed because of lack of glue.
There shouldn't be any glue as your domain is a .com and your name servers are .org.

Oh, blood and shale. Snarked, we're running in circles. This isn't about what should be, it's about what is. Specifically, it's about how the Sage test behaves. From a functional perspective, sure, you are right - v6ns.org's NS is AAAA reachable with ipv6 glue at .org, it has the AAAA records for ns1.sub.v6ns.org, and therefore the "ipv6 chain" is not broken, and everyone should go home happy.

Except, this is about what Sage tests for - and it tests for a AAAA record for your NS at the TLD, whether you're in-bailiwick or out-of-bailiwick, whether your NS is reachable purely through v6 by other means or whether it is not. Doesn't matter to the Sage test.

Do me a favor - just test it. Start a cert process with a domain hosted on afraid.org - use something not ending in .org for giggles - then set out-of-bailiwick NS from yoursub.v6ns.org, and see how the tests behave. You'll pass Guru and be stuck at Sage.

Railing against that with "shoulds" is not very useful, in my book - that doesn't get the job done. The job in this case is to pass Sage. And that's what I aim to provide advice for.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 11, 2009, 11:01:12 AM
I'm not saying that there isn't a problem with an IPv6-only DNS walk that is required to pass the test.

However, the cause is NOT due to IPv6 glue records.  The cause is not having DNS servers with IPv6 addresses (which need NOT be glue records).  When the target zone is under a different TLD than the TLD(s) of the name servers that serve it, glue records don't exist (by definition).
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 11, 2009, 01:43:19 PM
However, the cause is NOT due to IPv6 glue records.  The cause is not having DNS servers with IPv6 addresses (which need NOT be glue records).  When the target zone is under a different TLD than the TLD(s) of the name servers that serve it, glue records don't exist (by definition).

Well, hmm, no? The DNS Servers still have AAAA records, and IPv6 addresses - needed for Guru. And that works fine.

As for out-of-bailiwick not having glue records by definition - whelp, that depends on what your definition of the word "is" is. Heh. In an ipv4 world, sure, you're right. In an IPv6 world, it's all about that unbroken v6 chain - so maybe "glue" isn't really the right term, and we should just call it a TLD AAAA host record - but then, that's a mouthful, and v6 glue is easier to say.

At any rate, that is what Sage tests for - the AAAA host record existing at the TLD level, whether you're in, out or between bailiwicks.

I think I'll rest my case, now.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: jimb on August 11, 2009, 04:16:45 PM
I noticed a few people mentioned on here that the glue records are kept on registrar's name servers for a given TLD.

I've always been under the impression that the registrars just submitted these host/glue records to whoever actually maintained the master name servers for a particular TLD via a back channel/process of some type.  Then they'd be distributed via normal DNS processes or whatever.

Kept on the registry's, not registrar's, name servers for a given TLD.

So, yes, you are right: Glue is a host record for your NS kept by "whoever maintains the authoritative name servers for a particular TLD" - the registry for that TLD.
Ah.  Maybe I misread registry as registrar.  Thanks for clearing it up for me.
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on August 12, 2009, 01:54:14 PM
RE - Yorick:  You don't understand what "glue" means.  It's defined in the DNS RFCs with a specific meaning.

Those IPv6 address records are NOT glue records.  They are for name servers whose hostnames are outside of the TLD of the domain being accessed.

Only address records for name servers INSIDE the zone (domain) they are part of are glue records (when at the parent zone's name servers).  Other address records for name servers are not glue records. 
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: leenoux on August 12, 2009, 08:25:41 PM
both yorick and snarked are right  :) in my perspective.
they're just not "in-synch" each oher  ;D

they're argumentations can causing acute headache, for people that does not have deeply knowledge about how dns works  ;D

** just joking **
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: yorick on August 13, 2009, 06:04:16 PM
they're argumentations can causing acute headache, for people that does not have deeply knowledge about how dns works  ;D

You're right about that - which is why this has now moved to PM. I hope those who are trying to complete Sage on afraid.org can still figure out how to do that from this at-times contentious thread. It certainly can be done, no matter what you end up calling the method by which it is done.  ;D
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: swschulz on October 10, 2009, 09:36:22 PM
Quick question for those who have made it through sage:

I currently have been working through the cert stages with a domain hosted at home.  That domain, abc.net, currently has two nameservers alpha.bravo.org and charlie.delta.com.  Both of those domain records are maintained at name.com who don't seem to support adding glue records.  On the other hand, abc.net is registered at GoDaddy, so I could easily add an IPv6 hostname to its record (e.g. ns1.abc.net) which could then have a glue record (if I understand the usage here correctly).

I wonder though if one can register a nameserver with only an IPv6 address?

Secondly, at this point the domain abc.net would have three nameservers.  Does the test check all three for glue records, or can I get past with only one?
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: jimb on October 10, 2009, 09:54:24 PM
Yes.  You can register a host record with only IPv6.  I did it for mine.  Worked with the test too.

My setup also had two IPv4 only name servers, and one IPv6 only name server.  Sage worked.

I can't quite remember if I used my 2nd level domain, or a subdomain for the Sage test.  I think I used a subdomain.  But I added that name server to my 2nd level too, along with the glue record (which means I get queries over IPv6 for my domain sometimes).

(EDIT: to clarify, the IPv6 name server I added was named the same as the subdomain, and listed as the name server for both the subdomain, and as one of the servers for the parent 2nd level domain)
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: swschulz on October 12, 2009, 02:47:12 PM
Thank you jimb... That did the trick.  I was getting confused by reading some of the posts in this thread, and was beginning to believe that these glue records were somehow different than the standard nameserver glue records.

Got mine added and waited for the he.net boxes to expire the old data, and now everything is golden.

I guess that feature is one more thing to consider when comparing domain name registrars.  I've emailed name.com in re: their support for IPv6 nameserver definitions, but have not yet received a response.  Guess I need to leave the nameservers on GD.

Again, many thanks for the quick clarification...

A Sage :)

Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: deags on November 25, 2009, 05:32:13 PM
Hi,
I think i have my setup correct just the test is not working?

http://network-tools.com/default.asp?prog=dnsrec&host=1.qld-rural.info

The domain i'm testing is 1.qld-rural.info

Entries at afraid.
   1.qld-rural.info (G)   NS   ns1.1.qld-rural.info
   1.qld-rural.info (G)   NS   ns2.1.qld-rural.info
   ns1.1.qld-rural.info (G)   A   60.241.215.178
   ns1.1.qld-rural.info (G)   AAAA   2001:0470:b8d9:0056:0000:0000:0000:000
   ns2.1.qld-rural.info (G)   A   204.42.254.5
   ns2.1.qld-rural.info (G)   AAAA   2001:418:3f4::5


The test is looking up the root nameservers?

Code: [Select]
NS Records: ns.1.qld-rural.info.
-TLD: info
-Server: b0.info.afilias-nst.org.
-Output: No Record
-Server: a2.info.afilias-nst.info.
-Output: No Record
-Server: b2.info.afilias-nst.org.
-Output: No Record
-Server: d0.info.afilias-nst.org.
-Output: No Record
-Server: a0.info.afilias-nst.info.
-Output: No Record
-Server: c0.info.afilias-nst.info.
-Output: No Record
1.qld-rural.info
1.qld-rural.info

Code: [Select]
# dig ns1.1.qld-rural.info AAAA @ns1.1.qld-rural.info

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> ns1.1.qld-rural.info AAAA @ns1.1.qld-rural.info
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44138
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; QUESTION SECTION:
;ns1.1.qld-rural.info.          IN      AAAA

;; ANSWER SECTION:
ns1.1.qld-rural.info.   86400   IN      AAAA    2001:470:b8d9:56::1

;; AUTHORITY SECTION:
1.qld-rural.info.       86400   IN      NS      ns2.1.qld-rural.info.
1.qld-rural.info.       86400   IN      NS      ns1.1.qld-rural.info.

;; ADDITIONAL SECTION:
ns1.1.qld-rural.info.   86400   IN      A       60.241.215.178
ns2.1.qld-rural.info.   86400   IN      A       204.42.254.5
ns2.1.qld-rural.info.   86400   IN      AAAA    2001:418:3f4::5

;; Query time: 244 msec
;; SERVER: 60.241.215.178#53(60.241.215.178)
;; WHEN: Fri Nov 27 07:02:19 2009
;; MSG SIZE  rcvd: 158
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: snarked on November 26, 2009, 12:21:01 PM
OK, but why should "1.qld-rural.info" be listed at the ".info" name servers?

"qld-rural.info" is the domain for which the ".info" servers would list NS records.

"1.qld-rural.info" is properly listed at the "afraid.org" servers with a delegation that includes glue.  Since all 4 servers for "qld-rural.info" are NOT under ".info" (but are under the ".org" TLD), no glue is needed at that level.


PS:  I prefer the advanced interface:  http://network-tools.com/nslook/Default.asp

From "dig +trace":
Quote
.         518400 IN NS E.ROOT-SERVERS.NET.
.         518400 IN NS K.ROOT-SERVERS.NET.
.         518400 IN NS M.ROOT-SERVERS.NET.
.         518400 IN NS H.ROOT-SERVERS.NET.
.         518400 IN NS F.ROOT-SERVERS.NET.
.         518400 IN NS J.ROOT-SERVERS.NET.
.         518400 IN NS I.ROOT-SERVERS.NET.
.         518400 IN NS C.ROOT-SERVERS.NET.
.         518400 IN NS B.ROOT-SERVERS.NET.
.         518400 IN NS D.ROOT-SERVERS.NET.
.         518400 IN NS L.ROOT-SERVERS.NET.
.         518400 IN NS G.ROOT-SERVERS.NET.
.         518400 IN NS A.ROOT-SERVERS.NET.
;; Received 299 bytes from ::1#53(::1) in 39 ms

info.         172800 IN NS C0.INFO.AFILIAS-NST.info.
info.         172800 IN NS D0.INFO.AFILIAS-NST.ORG.
info.         172800 IN NS A0.INFO.AFILIAS-NST.info.
info.         172800 IN NS B2.INFO.AFILIAS-NST.ORG.
info.         172800 IN NS A2.INFO.AFILIAS-NST.info.
info.         172800 IN NS B0.INFO.AFILIAS-NST.ORG.
;; Received 448 bytes from 2001:500:2f::f#53(F.ROOT-SERVERS.NET) in 64 ms

qld-rural.info.      86400 IN NS ns1.qld-rural.info.
qld-rural.info.      86400 IN NS ns2.qld-rural.info.
qld-rural.info.      86400 IN NS ns3.qld-rural.info.
qld-rural.info.      86400 IN NS ns4.qld-rural.info.
;; Received 181 bytes from 2001:500:1b::1#53(C0.INFO.AFILIAS-NST.info) in 79 ms

1.qld-rural.info.   3600 IN   NS ns2.1.qld-rural.info.
1.qld-rural.info.   3600 IN   NS ns1.1.qld-rural.info.
;; Received 169 bytes from 67.19.72.206#53(ns1.qld-rural.info) in 43 ms

1.qld-rural.info.   86400 IN SOA ns1.1.qld-rural.info. louis.1.qld-rural.info. (
            2009112501 ; serial
            28800      ; refresh (8 hours)
            7200       ; retry (2 hours)
            864000     ; expire (1 week 3 days)
            86400      ; minimum (1 day)
            )
1.qld-rural.info.   86400 IN NS ns1.1.qld-rural.info.
1.qld-rural.info.   86400 IN NS ns2.1.qld-rural.info.
;; Received 211 bytes from 2001:418:3f4::5#53(ns2.1.qld-rural.info) in 68 ms

SOA ns1.1.qld-rural.info. louis.1.qld-rural.info. 2009112501 28800 7200 864000 86400 from server ns2.1.qld-rural.info in 345 ms.
SOA ns1.1.qld-rural.info. louis.1.qld-rural.info. 2009112501 28800 7200 864000 86400 from server ns1.1.qld-rural.info in 271 ms.
Noting that "ns[1-4].qld-rural.info" map to the same addresses as "ns[1-4].afraid.org."



Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: dualarrow on March 11, 2012, 04:22:35 AM
Just in case anyone comes across this post and somehow thinks they can't complete SAGE if they have a domain on afraid.org, persist, as it can be done. I just completed SAGE.

You need think hard about what the glue is and how it's used. When you do this, you'll see you can use tunnelbroker's free DNS in conjunction with afraid to complete the test. It took me a day or 2 to wrap my brain around the solution, but it was worth it.

Andrew
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: onehalf3544 on October 25, 2012, 11:03:53 AM
Just in case anyone comes across this post and somehow thinks they can't complete SAGE if they have a domain on afraid.org, persist, as it can be done. I just completed SAGE.

Indeed! I have also just completed Sage test with domain from afraid.org. It all turned out to be very simple after some thinking and googling.
Sure it is much better (from the educational point of view) to setup a DNS server, but I had this done for Guru test, so I don't think I've missed anything (except paying the registrar for domain with a glue record of course =).
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: kasperd on October 26, 2012, 03:13:18 AM
I am curious how you pulled that off considering that none of the afraid.org DNS servers have an IPv6 address at all. Can you point me to a domain, where you made it work?
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: onehalf3544 on October 26, 2012, 08:03:07 AM
Actually ns1.afraid.org has AAAA record:
Code: [Select]
%host ns1.afraid.org | grep IPv6
ns1.afraid.org has IPv6 address 2607:f0d0:1102:d5::2
Domain used for test is onehalf3544.strangled.net
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: kasperd on October 26, 2012, 11:03:20 AM
Actually ns1.afraid.org has AAAA record
But ns1.afraid.org is not NS for afraid.org. So when you have ns1.afraid.org in your NS record, the resolver still has to lookup ns1.afraid.org, which means it will have to send the query to a NS for afraid.org, which is IPv4 only.

Domain used for test is onehalf3544.strangled.net
That passed the test? I think that is a bug in the test then. I don't think there is any way that domain can possibly be resolved by an IPv6 only DNS resolver. I tested it out with this dig command
Code: [Select]
dig -6 +trace -t aaaa onehalf3544.strangled.netTo my surprise that actually succeeded in resolving the domain. But when I did a tcpdump to find out how it managed to pull that off, I found that dig actually still sent some DNS queries over IPv4. In particular the AAAA query for ns1.afraid.org was sent over IPv4 from dig to my ISPs recursive resolvers.

Does the certification use a buggy dig command behind the scenes?
Title: Re: IPv6 glue test impossible with afraid.org domains?
Post by: onehalf3544 on October 26, 2012, 12:06:51 PM
Actually ns1.afraid.org has AAAA record
But ns1.afraid.org is not NS for afraid.org. So when you have ns1.afraid.org in your NS record, the resolver still has to lookup ns1.afraid.org, which means it will have to send the query to a NS for afraid.org, which is IPv4 only.
I agree.

Domain used for test is onehalf3544.strangled.net
That passed the test? I think that is a bug in the test then. I don't think there is any way that domain can possibly be resolved by an IPv6 only DNS resolver. I tested it out with this dig command
Code: [Select]
dig -6 +trace -t aaaa onehalf3544.strangled.netTo my surprise that actually succeeded in resolving the domain. But when I did a tcpdump to find out how it managed to pull that off, I found that dig actually still sent some DNS queries over IPv4. In particular the AAAA query for ns1.afraid.org was sent over IPv4 from dig to my ISPs recursive resolvers.

Does the certification use a buggy dig command behind the scenes?
Maybe their dig is buggy, but they don't even run it with "-6" option.
And their checks don't care about the entire chain - Guru test runs the following (http://ipv6.he.net/presentations/guru.pdf):
Code: [Select]
dig NS $domain
dig AAAA $NS
dig AAAA $domain @$nsAAAA

Sage test (http://ipv6.he.net/presentations/sage.pdf):
Code: [Select]
dig NS $domain
dig AAAA $ns @$tld_server

All those commands run successfully even with "-6" option.

But I agree that tests should be tweaked to check for ipv6-only reachability.