Determine if DNS server is master or slave with DiG

Question

Is there a way to use DiG or nslookup to determine if a server is set to Master or Slave? And if a server is slave, return the Master's IP address?

Solution 1

As far as I know, the answer is no -- certainly no standard way, since there are a billion different DNS server variants. One option would be to have a 'masterdns.mydomain.com' record, guaranteed to contain the IP address of the master (don't even expose it, no need) -- then all you need to do is compare the IP of the DNS server to the IP it gives you for the master, and you're all set. This is also imperfect, because of aliasing / multi-homing / whatever-the-hell (you can't guarantee that it's a different server), but ..

.. you seem to be implying that you're setting all this up yourself, in which case you should just have the masterdns.mydomain.com record.

Solution 2

No, there is no way. The DNS protocol provides nothing to learn the master/slave relationship from the outside.

Also, this distinction is often gone today. Many domains have only masters, synchronized on a common database.

You can use heuristics (see Maas' suggestions or use the increase of serial numbers, the first name server to increase will be the master) but they are clearly not reliable.

Solution 3

First, technically a DNS server is not necessarily exclusively a master or a slave. This can be different on a domain by domain basis. It might be master for some domains and slave for others.

If the domain name's DNS zone is configured correctly - then you can request the zone's SOA-record which (amongst other things) contains the host name of the primary DNS server (the master).

For example:

C:\>nslookup
Default Server:  UnKnown
Address:  192.168.1.1

> set type=SOA
> google.com.
Server:  UnKnown
Address:  192.168.1.1

Non-authoritative answer:
google.com
        primary name server = ns1.google.com
        responsible mail addr = dns-admin.google.com
        serial  = 1396486
        refresh = 7200 (2 hours)
        retry   = 1800 (30 mins)
        expire  = 1209600 (14 days)
        default TTL = 300 (5 mins)

You can now do another lookup on the primary server name (from the SOA-record - in this case "ns1.google.com"), to get the master's IP address:

C:\nslookup ns1.google.com.
Server:  UnKnown
Address:  192.168.1.1

Non-authoritative answer:
Name:    ns1.google.com
Address:  216.239.32.10

The answer in this case is 216.239.32.10

Comments

[Michael Moser]

We run pdns authoritatively and have a customer that wants to use us as slave. He has numerous zones specified, and I am trying to find a way programmatically to process that list and determine if our server is set up as Native, Slave or Master. I don't have mysql access to filter the dns tables so I was hoping that there was a way to use Dig to discover Native, Slave or Master to use in my script.

[bortzmeyer]

This field exists, in the SOA record. It is supposed to contain the master, even hidden. In practice, it is not always reliable. Its only practical use is to be the target of dynamic updates.

[Doug Luxem]

+1 according to RFC the SOA record should have the primary source of the records for the domain listed (MNAME). Of course, most DNS implementations probably don't force this.