-nsid option results in 0 answers
I've observed a strange issue, when using check-soa with the KE ccTLD. Without any options, I get a normal response:
~% check-soa ke
kenic.anycastdns.cz.
185.28.194.194: OK: 2020072343
185.38.108.108: OK: 2020072343
mzizi.kenic.or.ke.
2001:43f8:10:0:50c0:a8ff:feee:30: OK: 2020072373
198.32.67.9: OK: 2020072373
196.1.4.130: OK: 2020072373
196.1.4.3: OK: 2020072373
ns-ke.afrinic.net.
2001:43f8:120::22: OK: 2020072373
196.216.168.22: OK: 2020072373
ns.anycast.kenic.or.ke.
204.61.216.7: OK: 2020072373
2001:500:14:6007:ad::1: OK: 2020072373
ns2ke.dns.business.
147.135.106.237: OK: 2020072373
2604:2dc0:200:2eb::237: OK: 2020072373
However, if I add -nsid, then the server kenic.anycastdns.cz
shows 0 answers:
~% check-soa -nsid ke
kenic.anycastdns.cz.
185.38.108.108: ERROR: 0 answer
185.28.194.194: ERROR: 0 answer
mzizi.kenic.or.ke.
2001:43f8:10:0:50c0:a8ff:feee:30: OK: 2020072373
198.32.67.9: OK: 2020072373
196.1.4.3: OK: 2020072373
196.1.4.130: OK: 2020072373
ns-ke.afrinic.net.
2001:43f8:120::22: OK: 2020072373 (NSID s03-ns2.jnb)
196.216.168.22: OK: 2020072373 (NSID s03-ns2.jnb)
ns.anycast.kenic.or.ke.
2001:500:14:6007:ad::1: OK: 2020072373 (NSID 5.ams.pch)
204.61.216.7: OK: 2020072373 (NSID 1.ams.pch)
ns2ke.dns.business.
147.135.106.237: OK: 2020072373
2604:2dc0:200:2eb::237: OK: 2020072373
I can query kenic.anycastdns.cz
with dig and options similar to check-soa, and I do get a proper response:
; <<>> DiG 9.16.5 <<>> +norec +dnssec +nsid ke soa @kenic.anycastdns.cz
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29395
;; flags: qr aa; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1480
;; QUESTION SECTION:
;ke. IN SOA
;; ANSWER SECTION:
ke. 3600 IN SOA mzizi.kenic.or.ke. hostmaster.kenic.or.ke. 2020072343 21600 3600 604800 3600
ke. 3600 IN RRSIG SOA 8 1 3600 20200805194330 20200723064129 63355 ke. rc/Ky8sfvPyHTuXD1CINBOc26g0WwSNpf5hVpaUDaPlLFazFiBFatvpA nATWNETr5SNUCrL6HTNlJTONqHl01vnTHOs0SqNoialZHAAXyUK+H65i 7sK3K9F0PqS8crJbeNu4Q55gJZOSZOuVoL/rNw7E2S/EE8XhSaIxPc5h NV2n52dngfa95AsqYIS46aooWmFtEbLdmLoFVYhU7z79GzZ61KWOQd2U 37qTXodAf1w6MczYr1OLo1ChtHyC2qzPJ/F2Eqj8r32gGnv/IpFWdmQG r5jh1GJk6Drp/cjyXLwQgJUz0nt3h3cQ84i7d0enpzxdoan7vo27dRjO 5Ar26g==
;; Query time: 22 msec
;; SERVER: 185.28.194.194#53(185.28.194.194)
;; WHEN: Thu Jul 23 17:39:14 CEST 2020
;; MSG SIZE rcvd: 383
What's check-soa doing differently?