doc/man1/haeredes.1

   1 .TH haeredes 1
   2
   3 .SH NAME
   4 haeredes \- Confirm delegation of NS and MX records.
   5 .SH SYNOPSIS
   6
   7 \fBhaeredes\fR [\fIOPTIONS\fR] [\fIDELEGATES\fR]
   8 .SH INPUT
   9 .P
  10 A list of domains, separated by whitespace.
  11 .SH OUTPUT
  12 .P
  13 A list of domains which don't have the supplied (expected) delegates
  14 listed as their NS/MX records.
  15 .SH DESCRIPTION
  16 .P
  17 Haeredes is primarily useful for ISP network administrators. Customers
  18 will occasionally decide to switch hosts without alerting the current
  19 host; this can cause two problems.
  20 .P
  21 With NS records, the previous host (at the very least) keeps hosting a
  22 DNS zone that does nothing. If that host uses their authoritative
  23 nameserver as a caching lookup server as well, it may return
  24 incorrect results to queries about the domain in question.
  25 .P
  26 For MX records, the situation is slightly worse. Most mail servers
  27 will immediately accept mail for which the server thinks it is the
  28 ultimate destination. If a mail server is configured as the
  29 destination for a domain, but it is not the MX for that domain, then
  30 mail submitted to that server may possibly be lost. It is therefore
  31 important to remove domains from the old mail host as soon as the MX
  32 record is changed.
  33 .P
  34 Haeredes can alert administrators when NS/MX records are changed.
  35 .SH NORMALIZATION
  36 .P
  37 By default, domain/hostnames given will be normalized in two ways:
  38 .IP \[bu] 2
  39 All names will be lowercased.
  40
  41 .IP \[bu]
  42 All names will have a trailing dot (the DNS root) appended if one is
  43 not present. This can be controlled with the
  44 \fB\-\-no\-append\-root\fR flag.
  45 .SH QUERY RESULTS
  46 .P
  47 When Haeredes makes a query for an MX record, the result is parsed
  48 from the \(dqanswer\(dq section of the response. This is
  49 straightforward.
  50 .P
  51 For NS records, however, there are two sections that may contain
  52 results. If you query the authoritative nameservers for example.com,
  53 they will return the response in the \(dqanswer\(dq section, as with
  54 MX records:
  55
  56 .nf
  57 .I $ dig +short @a.iana-servers.net example.com NS
  58 b.iana-servers.net.
  59 a.iana-servers.net.
  60 .fi
  61 .P
  62 However, if you ask a root server, they will return the response in another section, called \(dqauthority\(dq. The \(dqanswer\(dq section is empty:
  63
  64 .nf
  65 .I $ dig +short @a.gtld-servers.net example.com NS
  66 .fi
  67 .P
  68 We have to request the \(dqauthority\(dq section explicitly:
  69
  70 .nf
  71 .I $ dig +noall +authority @a.gtld-servers.net example.com NS
  72 example.com.            172800  IN      NS      a.iana-servers.net.
  73 example.com.            172800  IN      NS      b.iana-servers.net.
  74 .fi
  75 .P
  76 Given Haeredes' use case, it is useful to combine the two. You can
  77 query a root server to check the registrar data, or a recursive
  78 resolver to check the data on the authoritative nameservers.
  79 .P
  80 So that's what we do. In NS mode, Haeredes will check both the
  81 \(dqanswer\(dq and \(dqauthority\(dq sections for results.
  82 .SH OPTIONS
  83
  84 .IP \fB\-\-no\-append\-root\fR,\ \fB-n\fR
  85 Don't append a trailing dot to any DNS names. If you know what you're
  86 doing, this can be used to check relative results. Otherwise, it will
  87 probably just lead to false positives.
  88 .IP \fB\-\-server\fR,\ \fB-s\fR
  89 Use the given DNS server rather than the resolvers listed in
  90 /etc/resolv.conf. Either an IP address or a hostname will work.
  91 .SH EXAMPLES
  92
  93 .IP \[bu] 2
  94 Make sure example.com has the expected name servers,
  95 [ab].iana-servers.net:
  96
  97 .nf
  98 .I $ haeredes a.iana-servers.net b.iana-servers.net <<< \(dqexample.com\(dq
  99 .fi
 100
 101 .IP \[bu] 2
 102 If you use \-\-no\-append\-root and your nameservers are rooted, you
 103 must remember to supply the trailing dot yourself. Otherwise, you'll
 104 get false positives.
 105
 106 .nf
 107 .I $ haeredes \-\-no\-append\-root \\\\
 108 .I "          a.iana-servers.net b.iana-servers.net" \\\\
 109 .I "          <<< \(dqexample.com\(dq"
 110 Domain \(dqexample.com\(dq delegates somewhere else:
 111 \(dqb.iana-servers.net.\(dq \(dqa.iana-servers.net.\(dq
 112 .fi
 113 .IP \[bu]
 114 Check orlitzky.com against the expected name servers, using
 115 a root nameserver (this checks the registrar configuration):
 116
 117 .nf
 118 .I $ haeredes --server d.gtld-servers.net dns1.viabit.com dns2.viabit.com \\\\
 119 .I "           <<< \(dqorlitzky.com\(dq"
 120 .fi
 121 .IP \[bu]
 122 Check orlitzky.com against only one of the expected two nameservers:
 123
 124 .nf
 125 .I $ haeredes dns1.viabit.com <<< \(dqorlitzky.com\(dq
 126 Domain \(dqorlitzky.com.\(dq delegates somewhere else: \
 127 \(dqdns2.viabit.com.\(dq
 128 .fi
 129 .IP \[bu]
 130 Check a nonexistent domain (we provide no delegates, since we
 131 know .invalid will not be delegated):
 132
 133 .nf
 134 .I $ haeredes <<< \(dqexample.invalid\(dq
 135 Domain \(dqexample.invalid.\(dq not delegated.
 136 .fi
 137 .SH BUGS
 138 .P
 139 Send bugs to michael@orlitzky.com.