Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Geektools whois gateway has shut down after a 25-year run

geektools.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Geektools whois gateway has shut down after a 25-year run

#31

Post by b112 »

CydeWeys wrote: post #29
b112 wrote: post #22

Earlier quoted context omitted.

You need to dig the root nameservers these days, if you really want accurate glue record lookups. Don't trust whois.

Two different systems operating at different layers, though. I WHOIS the domain when I want to know which nameservers the registry thinks the domain should have. You can then dig in DNS to see what those nameservers are responding, but that's a separate level. (Note: I work in this field.)

It's unclear if you get what I mean, because you can never use whois, to determine what a glue record is, though. Whois is not updated reliably these days.

For example, you cannot 'whois example.org', see DNS servers listed, and think "OK, those are the glue servers!". Nope. You need to dig at the root .org DNS servers, and find out what they have configured as glue records, and then query that.

  $ dig +short org. NS
  c0.org.afilias-nst.info.
  d0.org.afilias-nst.org.
  b0.org.afilias-nst.org.
  a0.org.afilias-nst.info.
  b2.org.afilias-nst.org.
  a2.org.afilias-nst.info.

  $ dig +norec @a0.org.afilias-nst.info. example.org. NS
  
  
  ;; AUTHORITY SECTION:
  example.org.            3600    IN      NS      a.iana-      servers.net.
  example.org.            3600    IN      NS      b.iana-servers.net.
Now you know what the glue records are for a domain.

Trusting whois, which is sporadically updated these days, and often inaccurate, won't necessarily help anything.

I get why you do trust it, it used to be reliable, it used to be accurate, it just isn't in many cases any more.

As for what the registrar thinks, I wouldn't trust whois for that, either. Not these days. I'd want to query the registrar directly, to find out.

(Maybe you meant all of this, but at least it's clear for others now, either way)

Re: Geektools whois gateway has shut down after a 25-year run

#32

Post by CydeWeys »

b112 wrote: post #31
CydeWeys wrote: post #29

Earlier quoted context omitted.

Two different systems operating at different layers, though. I WHOIS the domain when I want to know which nameservers the registry thinks the domain should have. You can then dig in DNS to see what those nameservers are responding, but that's a separate level. (Note: I work in this field.)

It's unclear if you get what I mean, because you can never use whois, to determine what a glue record is, though. Whois is not updated reliably these days. For example, you cannot 'whois example.org', see DNS servers listed, and think "OK, those are the glue servers!". Nope. You need to dig at the root .org DNS servers, and find out what they have configured as glue records, and then query that. $ dig +short org. NS…

You're only talking about DNS. I'm talking about the layer above that, at the domain name registry, which is the authoritative source that feeds into DNS. The domain registry is typically implemented as a separate database distinct from DNS. The nameservers at the registry level are updated by registrars through a protocol called EPP (see RFCs 5730-5734). This is what then feeds into DNS. When you're debugging registry-level issues, e.g. maybe the registry isn't syncing to its DNS system correctly, you need to figure out what the registry thinks the name servers for a domain should be, and you do that through WHOIS (or soon, RDAP). Unlike DNS, these systems talk directly to the registry and let you know what the registry's view of the world is.

A domain that doesn't have any name servers configured on it cannot serve any content, and you can spin your wheels for a very long time if you're only playing around in DNS land. You'll see that there are no DNS entries being served up for the domain name at all but you won't know why, or how to actually fix it. You need to query the registry to find the root of the problem and realize that you need to set the name servers at the registry level (which as an end user you would have to do through your registrar, but which I as a registry operator can bypass).

Also, and I can't speak for other registry operators, but when you query us directly, you get a live view of the data, that is almost always real-time, but in the event of high load for WHOIS queries on that specific domain, might be served out of cache that persists for up to one minute. Point is it's more likely to be accurate at the present time than anything in DNS, which has more caching layers that last longer.

Re: Geektools whois gateway has shut down after a 25-year run

#33

Post by CydeWeys »

zinekeller wrote: post #12
lazide wrote: post #7

Earlier quoted context omitted.

If you register in a tld which doesn’t allow privacy (.net or .us? Forget which) everything leaks. Kiss goodbye to your phone number. I accidentally did this and got 50 calls within the first 8 hrs. It was insane.

It was .us, operated by GoDaddy ;) Not surprised on this, especially on the GoDaddy part . Although .uk also has no-proxies rule, at least Nominet themselves don't reveal your details if you're an individual even before GDPR (the idea being that if you're a company you have enough money to handle public requests).

For what it's worth, .us is the ccTLD for the United States, and policies for it like "You can't hide your WHOIS info" would be set by the US government, not by GoDaddy. GoDaddy Registry as the backend registry service provider isn't setting the policies for a ccTLD.

Re: Geektools whois gateway has shut down after a 25-year run

#34

Post by b112 »

CydeWeys wrote: post #32
b112 wrote: post #31

Earlier quoted context omitted.

It's unclear if you get what I mean, because you can never use whois, to determine what a glue record is, though. Whois is not updated reliably these days. For example, you cannot 'whois example.org', see DNS servers listed, and think "OK, those are the glue servers!". Nope. You need to dig at the root .org DNS servers, and find out what they have configured as glue records, and then query that. $ dig +short org. NS…

You're only talking about DNS. I'm talking about the layer above that, at the domain name registry, which is the authoritative source that feeds into DNS. The domain registry is typically implemented as a separate database distinct from DNS. The nameservers at the registry level are updated by registrars through a protocol called EPP (see RFCs 5730-5734). This is what then feeds into DNS. When you're debugging regist…

You're only talking about DNS.

Of course I am, that's the only way to know what the glue records actually are. Naturally there is the registrar side, but none of that means anything, when you're working with DNS, and need to know what is configured at the root server level.

Which is all that matters when you're doing DNS lookups.

My point here is, that using whois won't tell you that reliably. Only a direct root server lookup will.

What we're saying is not really that far apart, as we're both agreeing that whois is not the same as root server glue records.

Re: Geektools whois gateway has shut down after a 25-year run

#35

Post by zinekeller »

CydeWeys wrote: post #33
zinekeller wrote: post #12

Earlier quoted context omitted.

It was .us, operated by GoDaddy ;) Not surprised on this, especially on the GoDaddy part . Although .uk also has no-proxies rule, at least Nominet themselves don't reveal your details if you're an individual even before GDPR (the idea being that if you're a company you have enough money to handle public requests).

For what it's worth, .us is the ccTLD for the United States, and policies for it like "You can't hide your WHOIS info" would be set by the US government, not by GoDaddy. GoDaddy Registry as the backend registry service provider isn't setting the policies for a ccTLD.

> policies for it like "You can't hide your WHOIS info" would be set by the US government

I have actually checked this, and you're (partially) wrong on this one. To be fair, I was also wrong that GoDaddy (within limitations set by the Department of Commerce) has free reign here. The actual process is more boring: while the US DOC has veto powers, in practice it's the .US Stakeholder Council (https://www.about.us/stakeholders) which decides on matters about .US policies.

On that note, in the specific issue of no-proxies rule it was the US DOC who enforced it, not GoDaddy or Neustar (which was the previous operator): https://www.washingtonpost.com/wp-dyn/articles/A7251-2005Mar...

Post reply on HN