0

So I found another post saying that host and dig are essentially the same except host is a more user friendly. For the most part this seems to be true however I came across this when trying to find the SOA for one of my domains.

michael@collins:/etc/tinydns/root$ host -t SOA tareme.ddns.net
tareme.ddns.net has no SOA record
michael@collins:/etc/tinydns/root$ dig tareme.ddns.net SOA

; <<>> DiG 9.10.3-P4-Ubuntu <<>> tareme.ddns.net SOA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31834
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;tareme.ddns.net.       IN  SOA

;; AUTHORITY SECTION:
ddns.net.       1461    IN  SOA nf1.no-ip.com. hostmaster.no-ip.com. 2166190473 10800 1800 604800 1800

;; Query time: 23 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Jan 21 16:10:02 EST 2018
;; MSG SIZE  rcvd: 104

Additionally when trying to see the difference between them using tcpdump I got the following the first being the host request and the second being the dig.

16:09:44.276445 IP 10.0.0.5.33198 > google-public-dns-a.google.com.domain: 59495+ SOA? tareme.ddns.net. (33)
16:09:44.304564 IP google-public-dns-a.google.com.domain > 10.0.0.5.33198: 59495 0/1/0 (93)


16:10:02.653507 IP 10.0.0.5.59141 > google-public-dns-a.google.com.domain: 31834+ [1au] SOA? tareme.ddns.net. (44)
16:10:02.676878 IP google-public-dns-a.google.com.domain > 10.0.0.5.59141: 31834 0/1/1 (104)

seemingly the only difference is the [1au] in the dig request however googling I am unable to find what that means.

michael.schuett
  • 136
  • 9

2 Answers2

2

These two answers are actually consistent.

The dig output (essentially just a pretty-printed DNS message) shows a NODATA response (ie NOERROR status + SOA for the relevant zone in the AUTHORITY section). What this type of response means is that there is no record of the requested type (SOA) at tareme.ddns.net.

The host output represents the same situation as an English sentence.

Sidenote: If there had been a SOA record, it would be in the ANSWER section of the response and the owner name would be a match (ie, it would have had to be at tareme.ddns.net in this case).

Håkan Lindqvist
  • 35,011
  • 5
  • 69
  • 94
0

I read this wrong dig is actually not showing the SOA for tareme.ddns.com it's just outputting the SOA for ddns.com. If you use dig +short it's much easier to see no SOA is actually being returned.

The 1au seems to mean that we can accept UDP packets of size of size 4096. More about tcpdump can be found here.

michael.schuett
  • 136
  • 9