Previously if the resolver was asked for a record it didn't have, it would
return a response with a NS record in the authority section. This is
incorrect, as the lack of answer indicates to the resolver that it should try
that NS record as the next step, resulting in a loop:
$ dig @8.8.8.8 rbf-seed.btc.petertodd.org TXT +trace
<snip>
rbf-seed.btc.petertodd.org. 300 IN NS rbf-seed-ns1.btc.petertodd.org.
rbf-seed.btc.petertodd.org. 300 IN NS rbf-seed-ns2.btc.petertodd.org.
;; Received 141 bytes from 205.251.193.174#53(ns-430.awsdns-53.com) in 426 ms
rbf-seed.btc.petertodd.org. 40000 IN NS rbf-seed-ns2.btc.petertodd.org.
;; BAD (HORIZONTAL) REFERRAL
;; Received 88 bytes from 185.52.1.173#53(rbf-seed-ns2.btc.petertodd.org) in 108 ms
rbf-seed.btc.petertodd.org. 40000 IN NS rbf-seed-ns2.btc.petertodd.org.
;; BAD (HORIZONTAL) REFERRAL
;; Received 88 bytes from 185.52.1.173#53(rbf-seed-ns2.btc.petertodd.org) in 108 ms
<snip>
rbf-seed.btc.petertodd.org. 40000 IN NS rbf-seed-ns2.btc.petertodd.org.
;; BAD (HORIZONTAL) REFERRAL
dig: too many lookups
The correct response in the authority section of a negative response is a SOA
record, which indicates that the answer is authoritative and the resolver can
consider the record missing and stop looking for it:
$ dig @8.8.8.8 rbf-seed.btc.petertodd.org TXT +trace
<snip>
rbf-seed.btc.petertodd.org. 300 IN NS rbf-seed-ns1.btc.petertodd.org.
rbf-seed.btc.petertodd.org. 300 IN NS rbf-seed-ns2.btc.petertodd.org.
;; Received 141 bytes from 205.251.196.185#53(ns-1209.awsdns-23.org) in 740 ms
rbf-seed.btc.petertodd.org. 40000 IN SOA rbf-seed-ns1.btc.petertodd.org. pete.petertodd.org. 1435846201 604800 86400 2592000 604800
;; Received 128 bytes from 104.236.95.174#53(rbf-seed-ns1.btc.petertodd.org) in 31 ms
There have been a few reports of problems resolving seed domains on some
ISPs - hopefully this was the root cause.
