Control: Name servers should answer authoritatively
Description
It is recommended that all the name servers should reply back authoritatively. If the name servers do not respond with authority, it is possible that some services will fail if they are configured to only work with authoritative DNS.
Usage
Run the control in your terminal:
powerpipe control run net_insights.control.dns_ns_authoritative
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run net_insights.control.dns_ns_authoritative --share
Steampipe Tables
Params
Args | Name | Default | Description | Variable |
---|---|---|---|---|
$1 | domain_names |
| DNS domain names. |
SQL
with domain_list as ( select distinct domain from net_dns_record where domain in (select jsonb_array_elements_text(to_jsonb($1::text[]))) order by domain),domain_ns_records as ( select domain, target from net_dns_record where domain in (select domain from domain_list order by domain) and type = 'NS' order by domain),ns_ips as ( select domain, ip, target, host(ip) as ip_text from net_dns_record where domain in (select target from domain_ns_records) and type = 'A' order by domain),ns_with_authoritative_stats as ( select domain_ns_records.domain, domain_ns_records.target, case when ns_ips.ip is null then false else (select count(*) from net_dns_record where domain = domain_ns_records.domain and dns_server = ns_ips.ip_text and type = 'SOA' group by domain) is not null end as is_authoritativefrom domain_ns_records left join ns_ips on domain_ns_records.target = ns_ips.domain and ns_ips.ip is not nullorder by domain_ns_records.target),ns_non_authoritative as ( select distinct domain from ns_with_authoritative_stats where not is_authoritative order by domain)select domain_list.domain as resource, case when ns_non_authoritative.domain is null then 'ok' else 'alarm' end as status, case when ns_non_authoritative.domain is null then domain_list.domain || ' name servers listed at parent server answer authoritatively.' else domain_list.domain || ' name servers do not answer authoritatively: [' || (select string_agg(target, ', ') from ns_with_authoritative_stats where domain = domain_list.domain and not is_authoritative) || '].' end as reasonfrom domain_list left join ns_non_authoritative on domain_list.domain = ns_non_authoritative.domain;