{"id":21464234,"url":"https://github.com/shuque/resolve","last_synced_at":"2025-07-15T03:32:42.575Z","repository":{"id":25391439,"uuid":"28820026","full_name":"shuque/resolve","owner":"shuque","description":"Command line iterative DNS resolution testing program","archived":false,"fork":false,"pushed_at":"2024-06-08T01:39:18.000Z","size":278,"stargazers_count":18,"open_issues_count":0,"forks_count":5,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-06-08T04:27:17.398Z","etag":null,"topics":["diagnostic-tool","dns","dnssec","iterative","resolutions","resolver"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shuque.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-01-05T16:06:06.000Z","updated_at":"2024-06-08T01:39:11.000Z","dependencies_parsed_at":"2024-02-17T02:27:12.324Z","dependency_job_id":"d3cd119b-625f-4177-aea0-fda7584c989d","html_url":"https://github.com/shuque/resolve","commit_stats":null,"previous_names":[],"tags_count":24,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuque%2Fresolve","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuque%2Fresolve/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuque%2Fresolve/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuque%2Fresolve/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shuque","download_url":"https://codeload.github.com/shuque/resolve/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":226017327,"owners_count":17560465,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["diagnostic-tool","dns","dnssec","iterative","resolutions","resolver"],"created_at":"2024-11-23T07:30:27.963Z","updated_at":"2025-07-15T03:32:42.564Z","avatar_url":"https://github.com/shuque.png","language":"Python","readme":"# resolve.py\n\nresolve.py  \nA command line iterative DNS resolution testing program  \nAuthor: Shumon Huque\n\nA command line tool to perform iterative DNS resolution of a single\nDNS name, type, and class. If either type or class or both are omitted, \nthen a default type of 'A' (IPv4 address record), and a default class \nof 'IN' (Internet class) are used.\n\nI originally wrote this program to investigate the behavior of authoritative\nservers in the presence of query name minimization. Since then I've gradually\ndeveloped it into a more full fledged iterative resolver. These days, I\ntypically use this program to debug a variety of DNS problems. I prefer it\nover \"dig +trace\", because the latter only resolves the exact name given to\nit and does not follow CNAME and DNAME redirections, does not support query\nname minimization, and does not perform DNSSEC validation. (The newer \"delv\"\nprogram that ships with ISC BIND, does do DNSSEC validation, but requires the\nhelp of a DNSSEC aware resolver, and does not perform iterative name resolution\nby itself).\n\nPre-requisites:  \n- Python 3\n- [dnspython module](http://www.dnspython.org/) (included with most Linux/*BSD distributions)\n- [python-cryptography](https://cryptography.io/en/latest/) for DNSSEC support.\n\nThe included document, [DNSSEC.md](DNSSEC.md) has many examples of the\nuse of DNSSEC with this program.\n\nIf you need to use a version without DNSSEC, because you haven't or don't\nwant to install the python-cryptography package, you can install and earlier\nearlier version of this program: v0.15 or v0.20 should run fine\nwithout them. Just checkout the corresponding tags from this repo, or\ngrab the release tarballs for those versions. Direct links to these\nearlier versions:\n- https://github.com/shuque/resolve/tree/v0.15\n- https://github.com/shuque/resolve/tree/v0.20\n\n\n### Usage\n\n```\nresolve.py version 0.6.7\nPerform iterative resolution of a DNS name, type, and class.\n\n    Usage: resolve.py [Options] \u003cqname\u003e [\u003cqtype\u003e] [\u003cqclass\u003e]\n           resolve.py [Options] -b \u003cbatchfile\u003e\n\n     Options:\n     -v: increase verbosity level by 1 (default 0)\n     -j: give JSON encoded output\n     -m: do qname minimization\n     -t: use TCP only\n     -s: print summary statistics\n     -n: resolve all non-glue NS addresses in referrals\n     -x: workaround NXDOMAIN on empty non-terminals\n     -eN: use EDNS0 buffer size N (default: 1460; 0=disable EDNS)\n     -z: perform DNSSEC validation (default is no)\n     -c: dump zone/ns/key caches at end of program execution\n     -4: only use IPv4 transport\n     -6: only use IPv6 transport\n     -b \u003cbatchfile\u003e: batch file mode\n\nWhen using -b, \u003cbatchfile\u003e contains one (space separated) query name, type,\nclass per line.\n```\n\n### Installation\n\nTo install system wide:\n\n* (as root) pip3 install git+https://github.com/shuque/resolve.git@v0.6.7\n\nTo install for your own account:\n\n* pip3 install git+https://github.com/shuque/resolve.git@v0.6.7\n\nTo install from a local copy of this repository:\n\n* pip3 install .\n\n\n### Examples\n\nThis program implements the normal iterative DNS resolution algorithm \ndescribed in the DNS protocol specifications.\n\nHere's a basic lookup of the IPv6 address of www.seas.upenn.edu:\n\n```\n$ resolve.py www.seas.upenn.edu. AAAA\n# ANSWER to QUERY: www.seas.upenn.edu. AAAA IN\n# RCODE: NOERROR\nwww.seas.upenn.edu. 120 IN AAAA 2607:f470:8:64:5ea5::9\n```\n\nA more complicated answer involving a chain of aliases:\n\n```\n$ resolve.py fda.my.salesforce.com\n# ANSWER to QUERY: fda.my.salesforce.com. A IN\n# RCODE: NOERROR\nfda.my.salesforce.com. 300 IN CNAME na21.my.salesforce.com.\nna21.my.salesforce.com. 300 IN CNAME na21-wax.gia1.my.salesforce.com.\nna21-wax.gia1.my.salesforce.com. 30 IN CNAME na21-wax.my.salesforce.com.\nna21-wax.my.salesforce.com. 120 IN A 96.43.153.40\nna21-wax.my.salesforce.com. 120 IN A 96.43.153.168\n```\n\nHere's the first lookup with the -v switch added (increase verbosity\nlevel), to show the iterative resolution path taken through the DNS\nhierarchy:\n\n```\n$ resolve.py -v www.seas.upenn.edu AAAA\nZONE: .\nTTL: Delegation: 518400\nNS: a.root-servers.net. 198.41.0.4 2001:503:ba3e::2:30\nNS: b.root-servers.net. 199.9.14.201 2001:500:200::b\nNS: c.root-servers.net. 192.33.4.12 2001:500:2::c\nNS: d.root-servers.net. 199.7.91.13 2001:500:2d::d\nNS: e.root-servers.net. 192.203.230.10 2001:500:a8::e\nNS: f.root-servers.net. 192.5.5.241 2001:500:2f::f\nNS: g.root-servers.net. 192.112.36.4 2001:500:12::d0d\nNS: h.root-servers.net. 198.97.190.53 2001:500:1::53\nNS: i.root-servers.net. 192.36.148.17 2001:7fe::53\nNS: j.root-servers.net. 192.58.128.30 2001:503:c27::2:30\nNS: k.root-servers.net. 193.0.14.129 2001:7fd::1\nNS: l.root-servers.net. 199.7.83.42 2001:500:9f::42\nNS: m.root-servers.net. 202.12.27.33 2001:dc3::35\n\n# QUERY: www.seas.upenn.edu. AAAA IN at zone . address 2001:503:ba3e::2:30\n#        [Referral to zone: edu. in 0.013 s]\nZONE: edu.\nTTL: Delegation: 172800\nNS: a.edu-servers.net. 192.5.6.30 2001:503:a83e::2:30\nNS: b.edu-servers.net. 192.33.14.30 2001:503:231d::2:30\nNS: c.edu-servers.net. 192.26.92.30 2001:503:83eb::30\nNS: d.edu-servers.net. 192.31.80.30 2001:500:856e::30\nNS: e.edu-servers.net. 192.12.94.30 2001:502:1ca1::30\nNS: f.edu-servers.net. 192.35.51.30 2001:503:d414::30\nNS: g.edu-servers.net. 192.42.93.30 2001:503:eea3::30\nNS: h.edu-servers.net. 192.54.112.30 2001:502:8cc::30\nNS: i.edu-servers.net. 192.43.172.30 2001:503:39c1::30\nNS: j.edu-servers.net. 192.48.79.30 2001:502:7094::30\nNS: k.edu-servers.net. 192.52.178.30 2001:503:d2d::30\nNS: l.edu-servers.net. 192.41.162.30 2001:500:d937::30\nNS: m.edu-servers.net. 192.55.83.30 2001:501:b1f9::30\n\n# QUERY: www.seas.upenn.edu. AAAA IN at zone edu. address 2001:502:8cc::30\n#        [Referral to zone: upenn.edu. in 0.029 s]\nZONE: upenn.edu.\nTTL: Delegation: 172800\nNS: dns1.udel.edu. 128.175.13.16\nNS: dns2.udel.edu. 128.175.13.17\nNS: adns2.upenn.edu. 128.91.254.22 2607:f470:1002::2:3\nNS: adns1.upenn.edu. 128.91.3.128 2607:f470:1001::1:a\nNS: adns3.upenn.edu. 128.91.251.33 2607:f470:1003::3:c\nNS: adns4.upenn.edu. 208.94.148.32 2600:1800:5::1:0\nNS: adns5.upenn.edu. 208.80.124.32 2600:1801:6::1:0\nNS: adns6.upenn.edu. 208.80.126.32 2600:1802:7::1:0\n\n# QUERY: www.seas.upenn.edu. AAAA IN at zone upenn.edu. address 2607:f470:1001::1:a\n#        [Got answer in 0.015 s]\n\n# ANSWER to QUERY: www.seas.upenn.edu. AAAA IN\n# RCODE: NOERROR\nwww.seas.upenn.edu. 120 IN AAAA 2607:f470:8:64:5ea5::9\n```\n\n### DNSSEC validation mode\n\nUse -z to turn on DNSSEC validation. In this mode, wih the -v switch,\nthe program additionally shows DS and DNSKEY record information, whether\nthe referrals encountered were secure or not, and whether the final\nanswer is end-to-end DNSSEC validated. Example output:\n\n```\n$ resolve.py -vz www.upenn.edu. A\nZONE: .\nTTL: Delegation: 518400\nNS: a.root-servers.net. 198.41.0.4 2001:503:ba3e::2:30\nNS: b.root-servers.net. 199.9.14.201 2001:500:200::b\nNS: c.root-servers.net. 192.33.4.12 2001:500:2::c\nNS: d.root-servers.net. 199.7.91.13 2001:500:2d::d\nNS: e.root-servers.net. 192.203.230.10 2001:500:a8::e\nNS: f.root-servers.net. 192.5.5.241 2001:500:2f::f\nNS: g.root-servers.net. 192.112.36.4 2001:500:12::d0d\nNS: h.root-servers.net. 198.97.190.53 2001:500:1::53\nNS: i.root-servers.net. 192.36.148.17 2001:7fe::53\nNS: j.root-servers.net. 192.58.128.30 2001:503:c27::2:30\nNS: k.root-servers.net. 193.0.14.129 2001:7fd::1\nNS: l.root-servers.net. 199.7.83.42 2001:500:9f::42\nNS: m.root-servers.net. 202.12.27.33 2001:dc3::35\nDNSKEY: . 256 46594 RSASHA256 (8) 2048-bits ZONE\nDNSKEY: . 257 20326 RSASHA256 (8) 2048-bits ZONE SEP\nDNSKEY: . 256 48903 RSASHA256 (8) 2048-bits ZONE\n\n# QUERY: www.upenn.edu. A IN at zone . address 2001:500:9f::42\n#        [SECURE Referral to zone: edu. in 0.024 s]\nZONE: edu.\nTTL: Delegation: 172800, Signer: 86400\nNS: a.edu-servers.net. 2001:503:a83e::2:30 192.5.6.30\nNS: b.edu-servers.net. 2001:503:231d::2:30 192.33.14.30\nNS: c.edu-servers.net. 2001:503:83eb::30 192.26.92.30\nNS: d.edu-servers.net. 2001:500:856e::30 192.31.80.30\nNS: e.edu-servers.net. 2001:502:1ca1::30 192.12.94.30\nNS: f.edu-servers.net. 2001:503:d414::30 192.35.51.30\nNS: g.edu-servers.net. 2001:503:eea3::30 192.42.93.30\nNS: h.edu-servers.net. 2001:502:8cc::30 192.54.112.30\nNS: i.edu-servers.net. 2001:503:39c1::30 192.43.172.30\nNS: j.edu-servers.net. 2001:502:7094::30 192.48.79.30\nNS: k.edu-servers.net. 2001:503:d2d::30 192.52.178.30\nNS: l.edu-servers.net. 2001:500:d937::30 192.41.162.30\nNS: m.edu-servers.net. 2001:501:b1f9::30 192.55.83.30\nDS: 28065 8 2 4172496cde85534e51129040355bd04b1fcfebae996dfdde652006f6f8b2ce76\nDNSKEY: edu. 257 28065 RSASHA256 (8) 2048-bits ZONE SEP\nDNSKEY: edu. 256 8663 RSASHA256 (8) 1280-bits ZONE\n\n# QUERY: www.upenn.edu. A IN at zone edu. address 2001:501:b1f9::30\n#        [SECURE Referral to zone: upenn.edu. in 0.006 s]\nZONE: upenn.edu.\nTTL: Delegation: 172800, Signer: 86400\nNS: dns1.udel.edu. 128.175.13.16\nNS: dns2.udel.edu. 128.175.13.17\nNS: adns2.upenn.edu. 128.91.254.22 2607:f470:1002::2:3\nNS: adns1.upenn.edu. 128.91.3.128 2607:f470:1001::1:a\nNS: adns3.upenn.edu. 128.91.251.33 2607:f470:1003::3:c\nNS: adns4.upenn.edu. 208.94.148.32 2600:1800:5::1:0\nNS: adns5.upenn.edu. 208.80.124.32 2600:1801:6::1:0\nNS: adns6.upenn.edu. 208.80.126.32 2600:1802:7::1:0\nDS: 10500 13 2 4629d71f8f9dd9ceac6a047041b161c9a7812406e449a80c0b319c3925b48c52\nDNSKEY: upenn.edu. 257 10500 ECDSA-P256 (13) 512-bits ZONE SEP\nDNSKEY: upenn.edu. 256 54481 ECDSA-P256 (13) 512-bits ZONE\n\n# QUERY: www.upenn.edu. A IN at zone upenn.edu. address 208.80.126.32\n#        [Got answer in 0.007 s]\n# SECURE: www.upenn.edu. 300 IN A 151.101.130.217\n# SECURE: www.upenn.edu. 300 IN A 151.101.194.217\n# SECURE: www.upenn.edu. 300 IN A 151.101.66.217\n# SECURE: www.upenn.edu. 300 IN A 151.101.2.217\n\n# ANSWER to QUERY: www.upenn.edu. A IN\n# RCODE: NOERROR\n# DNSSEC status: SECURE\nwww.upenn.edu. 300 IN A 151.101.130.217\nwww.upenn.edu. 300 IN A 151.101.194.217\nwww.upenn.edu. 300 IN A 151.101.66.217\nwww.upenn.edu. 300 IN A 151.101.2.217\n```\n\nMany more examples of DNSSEC, including both successful and failed responses\nof various kinds (DS mismatch, signature verification failures, signature\nexpirations, and more) are included in the accompanying document\n[DNSSEC.md](DNSSEC.md).\n\n\n### Batch mode\n\nIf executing many different queries, then it is recommended to use\nthe batch mode (-b inputfile). This will cause the program to use its\ncache of previously queried zones and nameserver records, increasing\nperformance, and reducing the possibility of responses being rate\nlimited by authoritative servers.\n\nThe format of the batch input file is a space-separated query-name,\nquery-type, and query-class per line. The type and class if omitted\ndefault to 'A' and 'IN'.\n\n\n### Query-name minimization mode\n\nWhen invoked with the -m switch, this program uses a **query name \nminimization** algorithm that exposes only the needed query labels to \nauthoritative servers as it traverses the DNS delegation hierarchy down \nto the target DNS zone. This is a more *privacy preserving* mode of DNS \nresolution, that is specified in\n[RFC 7816](https://tools.ietf.org/html/rfc7816). The program deviates\nslightly from that specification, in that it makes no attempt to hide\nthe query-type (e.g. by issuing NS record queries until it reaches the\ntarget zone). Experience in the field has shown that there are many\nnameservers that unfortunately don't respond to NS queries.\n\nHere's an example run with qname minimization (-m) and the verbose (-v)\noption:\n\n```\n$ resolve.py -vm www.seas.upenn.edu AAAA\nZONE: .\nTTL: Delegation: 518400\nNS: a.root-servers.net. 198.41.0.4 2001:503:ba3e::2:30\nNS: b.root-servers.net. 199.9.14.201 2001:500:200::b\nNS: c.root-servers.net. 192.33.4.12 2001:500:2::c\nNS: d.root-servers.net. 199.7.91.13 2001:500:2d::d\nNS: e.root-servers.net. 192.203.230.10 2001:500:a8::e\nNS: f.root-servers.net. 192.5.5.241 2001:500:2f::f\nNS: g.root-servers.net. 192.112.36.4 2001:500:12::d0d\nNS: h.root-servers.net. 198.97.190.53 2001:500:1::53\nNS: i.root-servers.net. 192.36.148.17 2001:7fe::53\nNS: j.root-servers.net. 192.58.128.30 2001:503:c27::2:30\nNS: k.root-servers.net. 193.0.14.129 2001:7fd::1\nNS: l.root-servers.net. 199.7.83.42 2001:500:9f::42\nNS: m.root-servers.net. 202.12.27.33 2001:dc3::35\n\n# QUERY: edu. AAAA IN at zone . address 2001:500:2::c\n#        [Referral to zone: edu. in 0.014 s]\nZONE: edu.\nTTL: Delegation: 172800\nNS: d.edu-servers.net. 2001:500:856e::30 192.31.80.30\nNS: f.edu-servers.net. 2001:503:d414::30 192.35.51.30\nNS: l.edu-servers.net. 2001:500:d937::30 192.41.162.30\nNS: e.edu-servers.net. 2001:502:1ca1::30 192.12.94.30\nNS: c.edu-servers.net. 2001:503:83eb::30 192.26.92.30\nNS: m.edu-servers.net. 2001:501:b1f9::30 192.55.83.30\nNS: h.edu-servers.net. 2001:502:8cc::30 192.54.112.30\nNS: i.edu-servers.net. 2001:503:39c1::30 192.43.172.30\nNS: j.edu-servers.net. 2001:502:7094::30 192.48.79.30\nNS: a.edu-servers.net. 2001:503:a83e::2:30 192.5.6.30\nNS: k.edu-servers.net. 2001:503:d2d::30 192.52.178.30\nNS: b.edu-servers.net. 2001:503:231d::2:30 192.33.14.30\nNS: g.edu-servers.net. 2001:503:eea3::30 192.42.93.30\n\n# QUERY: upenn.edu. AAAA IN at zone edu. address 192.12.94.30\n#        [Referral to zone: upenn.edu. in 0.050 s]\nZONE: upenn.edu.\nTTL: Delegation: 172800\nNS: dns1.udel.edu. 128.175.13.16\nNS: dns2.udel.edu. 128.175.13.17\nNS: adns2.upenn.edu. 128.91.254.22 2607:f470:1002::2:3\nNS: adns1.upenn.edu. 128.91.3.128 2607:f470:1001::1:a\nNS: adns3.upenn.edu. 128.91.251.33 2607:f470:1003::3:c\nNS: adns4.upenn.edu. 208.94.148.32 2600:1800:5::1:0\nNS: adns5.upenn.edu. 208.80.124.32 2600:1801:6::1:0\nNS: adns6.upenn.edu. 208.80.126.32 2600:1802:7::1:0\n\n# QUERY: seas.upenn.edu. AAAA IN at zone upenn.edu. address 2607:f470:1001::1:a\n#        [Got answer in 0.009 s]\n\n# QUERY: www.seas.upenn.edu. AAAA IN at zone upenn.edu. address 2600:1802:7::1:0\n#        [Got answer in 0.006 s]\n\n# ANSWER to QUERY: www.seas.upenn.edu. AAAA IN\n# RCODE: NOERROR\nwww.seas.upenn.edu. 120 IN AAAA 2607:f470:8:64:5ea5::9\n```\n\nSome Content Delivery Networks (CDN) like Akamai and Cloudflare have \nproblems with minimized query names, because they respond incorrectly\nto intermediate query names with NXDOMAIN (response code 3). The correct\nresponse should be NOERROR, AA-bit set, and an empty answer section. \nInvoking resolve.py with the -x switch implements a hack that works \naround this incorrect behavior by ignoring intermediate NXDOMAIN \nresponses. The Cloudflare servers additionally appear to respond to \nsome intermediate qnames with REFUSED.\n\nThis behavior of the Akamai and Cloudflare DNS servers was observed \nin January 2015. Further details can be found in a\n[presentation I did on this topic at the summer 2015 DNS-OARC workshop](https://indico.dns-oarc.net/event/21/contributions/298/attachments/267/487/qname-min.pdf). Cloudflare has already fixed their DNS implementation (April 2015).\nAkamai has partially done so.\n\nThe examples below used an older version of the program that shows\na bit less information (namely, it doesn't show the server IP address\nqueried or associated referral data).\n\nAttempted resolution of www.upenn.edu (on Akamai, January 2015):\n\n```\n$ resolve.py -vm www.upenn.edu. A\n\u003e\u003e Query: edu. A IN at zone .\n\u003e\u003e        [Got Referral to zone: edu.]\n\u003e\u003e Query: upenn.edu. A IN at zone edu.\n\u003e\u003e        [Got Referral to zone: upenn.edu.]\n\u003e\u003e Query: www.upenn.edu. A IN at zone upenn.edu.\nwww.upenn.edu. 300 IN CNAME www.upenn.edu-dscg.edgesuite.net.\n\u003e\u003e Query: net. A IN at zone .\n\u003e\u003e        [Got Referral to zone: net.]\n\u003e\u003e Query: edgesuite.net. A IN at zone net.\n\u003e\u003e        [Got Referral to zone: edgesuite.net.]\n\u003e\u003e Query: edu-dscg.edgesuite.net. A IN at zone edgesuite.net.\nERROR: NXDOMAIN: edu-dscg.edgesuite.net. not found\nwww.upenn.edu. 300 IN CNAME www.upenn.edu-dscg.edgesuite.net.\n```\n\nRepeating the query with -x (intermediate NXDOMAIN workaround) allows\nthe program to proceed to the final answer:\n\n```\n$ resolve.py -vmx www.upenn.edu\n\u003e\u003e Query: edu. A IN at zone .\n\u003e\u003e        [Got Referral to zone: edu.]\n\u003e\u003e Query: upenn.edu. A IN at zone edu.\n\u003e\u003e        [Got Referral to zone: upenn.edu.]\n\u003e\u003e Query: www.upenn.edu. A IN at zone upenn.edu.\nwww.upenn.edu. 300 IN CNAME www.upenn.edu-dscg.edgesuite.net.\n\u003e\u003e Query: net. A IN at zone .\n\u003e\u003e        [Got Referral to zone: net.]\n\u003e\u003e Query: edgesuite.net. A IN at zone net.\n\u003e\u003e        [Got Referral to zone: edgesuite.net.]\n\u003e\u003e Query: edu-dscg.edgesuite.net. A IN at zone edgesuite.net.\nERROR: NXDOMAIN: edu-dscg.edgesuite.net. not found\n\u003e\u003e Query: upenn.edu-dscg.edgesuite.net. A IN at zone edgesuite.net.\nERROR: NXDOMAIN: upenn.edu-dscg.edgesuite.net. not found\n\u003e\u003e Query: www.upenn.edu-dscg.edgesuite.net. A IN at zone edgesuite.net.\nwww.upenn.edu-dscg.edgesuite.net. 21600 IN CNAME a1165.dscg.akamai.net.\n\u003e\u003e Query: akamai.net. A IN at zone net.\n\u003e\u003e        [Got Referral to zone: akamai.net.]\n\u003e\u003e Query: dscg.akamai.net. A IN at zone akamai.net.\n\u003e\u003e Query: a1165.dscg.akamai.net. A IN at zone akamai.net.\n\u003e\u003e        [Got Referral to zone: dscg.akamai.net.]\n\u003e\u003e Query: a1165.dscg.akamai.net. A IN at zone dscg.akamai.net.\nwww.upenn.edu. 300 IN CNAME www.upenn.edu-dscg.edgesuite.net.\nwww.upenn.edu-dscg.edgesuite.net. 21600 IN CNAME a1165.dscg.akamai.net.\na1165.dscg.akamai.net. 20 IN A 23.62.6.59\na1165.dscg.akamai.net. 20 IN A 23.62.6.81\n```\n\nResolving www.ietf.org (on Cloudflare, January 2015) with the NXDOMAIN\nworkaround shows the following:\n\nIn this case, the first empty non-terminal, cdn.cloudflare.net returns\nNXDOMAIN, the next one, org.cdn.cloudflare.net returns REFUSED, the\nnext one, ietf.org.cdn.cloudflare.net responds correctly (NOERROR, AA-bit,\nempty answer), and the final name www.ietf.org.cdn.cloudflare.net produces\nthe answer records.\n\n```\n$ resolve.py -vmx www.ietf.org\n\u003e\u003e Query: org. A IN at zone .\n\u003e\u003e        [Got Referral to zone: org.]\n\u003e\u003e Query: ietf.org. A IN at zone org.\n\u003e\u003e        [Got Referral to zone: ietf.org.]\n\u003e\u003e Query: www.ietf.org. A IN at zone ietf.org.\nwww.ietf.org. 1800 IN CNAME www.ietf.org.cdn.cloudflare.net.\n\u003e\u003e Query: cloudflare.net. A IN at zone net.\n\u003e\u003e        [Got Referral to zone: cloudflare.net.]\n\u003e\u003e Query: cdn.cloudflare.net. A IN at zone cloudflare.net.\nERROR: NXDOMAIN: cdn.cloudflare.net. not found\n\u003e\u003e Query: org.cdn.cloudflare.net. A IN at zone cloudflare.net.\nWARNING: response REFUSED from 173.245.59.31\nWARNING: response REFUSED from 2400:cb00:2049:1::adf5:3b1f\nWARNING: response REFUSED from 198.41.222.131\nWARNING: response REFUSED from 2400:cb00:2049:1::c629:de83\nWARNING: response REFUSED from 198.41.222.31\nWARNING: response REFUSED from 2400:cb00:2049:1::c629:de1f\nWARNING: response REFUSED from 198.41.223.131\nWARNING: response REFUSED from 2400:cb00:2049:1::c629:df83\nWARNING: response REFUSED from 198.41.223.31\nWARNING: response REFUSED from 2400:cb00:2049:1::c629:df1f\nERROR: Queries to all servers for zone cloudflare.net. failed.\n\u003e\u003e Query: ietf.org.cdn.cloudflare.net. A IN at zone cloudflare.net.\n\u003e\u003e Query: www.ietf.org.cdn.cloudflare.net. A IN at zone cloudflare.net.\nwww.ietf.org. 1800 IN CNAME www.ietf.org.cdn.cloudflare.net.\nwww.ietf.org.cdn.cloudflare.net. 300 IN A 104.20.0.85\nwww.ietf.org.cdn.cloudflare.net. 300 IN A 104.20.1.85\n```\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshuque%2Fresolve","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshuque%2Fresolve","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshuque%2Fresolve/lists"}