<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet href="https://shkspr.mobi/blog/wp-content/themes/edent-wordpress-theme/rss-style.xsl" type="text/xsl"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	    xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	     xmlns:dc="http://purl.org/dc/elements/1.1/"
	   xmlns:atom="http://www.w3.org/2005/Atom"
	     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	  xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>
<channel>
	<title>DNS Esoterica &#8211; Why you can&#8217;t dig Switzerland &#8211; Terence Eden’s Blog</title>
	<atom:link href="https://shkspr.mobi/blog/2022/07/dns-esoterica-why-you-cant-dig-switzerland/feed/" rel="self" type="application/rss+xml" />
	<link>https://shkspr.mobi/blog</link>
	<description>Regular nonsense about tech and its effects 🙃</description>
	<lastBuildDate>Mon, 14 Jul 2025 14:48:58 +0000</lastBuildDate>
	<language>en-GB</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://shkspr.mobi/blog/wp-content/uploads/2023/07/cropped-avatar-32x32.jpeg</url>
	<title>DNS Esoterica &#8211; Why you can&#8217;t dig Switzerland &#8211; Terence Eden’s Blog</title>
	<link>https://shkspr.mobi/blog</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title><![CDATA[DNS Esoterica - Why you can't dig Switzerland]]></title>
		<link>https://shkspr.mobi/blog/2022/07/dns-esoterica-why-you-cant-dig-switzerland/</link>
					<comments>https://shkspr.mobi/blog/2022/07/dns-esoterica-why-you-cant-dig-switzerland/#comments</comments>
				<dc:creator><![CDATA[@edent]]></dc:creator>
		<pubDate>Thu, 14 Jul 2022 11:34:18 +0000</pubDate>
				<category><![CDATA[/etc/]]></category>
		<category><![CDATA[dns]]></category>
		<category><![CDATA[internet]]></category>
		<category><![CDATA[trivia]]></category>
		<guid isPermaLink="false">https://shkspr.mobi/blog/?p=43028</guid>

					<description><![CDATA[As part of my new job, I&#039;m learning a lot more about the mysteries of the Domain Name System than any mortal should know I thought possible.  The humble unix dig command allows you to query all sort of DNS information. For example, to see name server records for the BBC website, you can run:  dig bbc.co.uk NS  Which will get you:  ;; Got answer: ;; -&#62;&#62;HEADER&#60;&#60;- opcode: QUERY, status: NOERROR, id: …]]></description>
										<content:encoded><![CDATA[<p>As part of my new job, I'm learning a lot more about the mysteries of the Domain Name System than <del>any mortal should know</del> I thought possible.</p>

<p>The humble unix <code>dig</code> command allows you to query all sort of DNS information. For example, to see name server records for the BBC website, you can run:</p>

<p><code>dig bbc.co.uk NS</code></p>

<p>Which will get you:</p>

<pre><code class="language-_">;; Got answer:
;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 35614
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 17

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 097db2ee4c92b84982083ecf62b5b5f2007906e616035113 (good)
;; QUESTION SECTION:
;bbc.co.uk.         IN  NS

;; ANSWER SECTION:
bbc.co.uk.      900 IN  NS  ddns1.bbc.com.
bbc.co.uk.      900 IN  NS  dns0.bbc.co.uk.
bbc.co.uk.      900 IN  NS  ddns1.bbc.co.uk.
...
</code></pre>

<p>And a whole lot more.  But you can go further down the DNS tree. What are the nameservers for <code>.co.uk</code>?</p>

<p><code>dig co.uk NS</code></p>

<p>And you'll get your answer.  You can go one further and see the nameservers for the Top Level Domain:</p>

<p><code>dig uk NS</code></p>

<p>Which replies with:</p>

<pre><code class="language-_">;; Got answer:
;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 54061
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 17

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 880427eda8ff71de2ab4f43862b5b65f95e317d29cc10a8e (good)
;; QUESTION SECTION:
;uk.                IN  NS

;; ANSWER SECTION:
uk.         159692  IN  NS  nsc.nic.uk.
uk.         159692  IN  NS  dns1.nic.uk.
uk.         159692  IN  NS  nsd.nic.uk.
...
</code></pre>

<p>And that works with <em>every</em> TLD. Countries like <code>de</code>, generic names like <code>museum</code>, and internationalised domains like <code>在线</code>. All of them work!</p>

<p>Except Switzerland.</p>

<p>Switzerland's country code is <code>ch</code> - after the name <i lang="la">Confoederatio Helvetica</i>. Let's run the <code>dig</code> on it: <code>dig ch NS</code></p>

<pre><code class="language-_">;; Got answer:
;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: REFUSED, id: 31910
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
</code></pre>

<p>We have been <strong>refused</strong> and <strong>warned</strong>.  But why does this only happen with Switzerland?</p>

<p>The blame - as with most modern ills - lies in the mid-1970s. The Bee Gees were storming the charts with "Jive Talkin'", the Rocky Horror Picture Show was gathering a cult following, and MIT scientists were causing chaos.  Literally.</p>

<p><a href="https://en.wikipedia.org/wiki/Chaosnet">Chaosnet</a> was an early network protocol designed for local networks.  It was technically very clever but, sadly, never really took off.</p>

<p>However, it found its way into DNS records. Let's go back to the answer to <code>dig bbc.co.uk NS</code>:</p>

<pre><code class="language-_">;; ANSWER SECTION:
bbc.co.uk.      900 IN  NS  ddns1.bbc.com.
</code></pre>

<p>OK, the first part is the domain name. The number is the TTL. The <code>IN</code> is the class. The NS says this is a nameserver record. And, finally, we get the domain of the nameserver.</p>

<p>But, in the class, what does <code>IN</code> stand for?</p>

<p>"<strong>Internet</strong>", obviously. Wait... Isn't the DNS on the Internet? Why do we need to specify that these DNS records are for Internet?</p>

<p>Well, isn't it obvious? Because you might want records of a <em>different</em> network. Like, for example, Chaosnet.</p>

<p>And if Internet is abbreviated to <code>IN</code>, what is Chaosnet shortened to? That's right! <code>CH</code>.</p>

<p>So, <code>dig</code> sees you enter <code>ch</code> for Switzerland, but thinks you're asking about <code>CH</code> for Chaosnet. And so it fails.</p>

<p>In order to query the records for <code>ch</code> we need to provide an absolutely fully-qualified domain name. It's as simple as sticking a dot at the end of the domain name:</p>

<p><code>dig ch. NS</code></p>

<pre><code class="language-_">;; Got answer:
;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 64932
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 11

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: e19b9c23cdfa0f7bcf82750462b5c16b47744386c7974ffb (good)
;; QUESTION SECTION:
;ch.                IN  NS

;; ANSWER SECTION:
ch.         164894  IN  NS  e.nic.ch.
ch.         164894  IN  NS  a.nic.ch.
ch.         164894  IN  NS  f.nic.ch.
</code></pre>

<p>And there we go. A failed 1970s experiment like bell-bottoms and Betamax videos - but with much longer lasting consequences.</p>

<p>You can see some <code>CH</code> records by running like:</p>

<p><code>dig ch txt @f.root-servers.net version.bind</code></p>

<p>That will get you something like:</p>

<pre><code class="language-_">;; ANSWER SECTION:
version.bind.       86400   CH  TXT "cloudflare-f-root-20190930"
</code></pre>

<p>Of course, DNS doesn't <em>only</em> have <code>IN</code> and <code>CH</code> class records.</p>

<p>There's also <a href="https://en.wikipedia.org/wiki/Hesiod_(name_service)">Hesiod</a> - <code>HS</code>. But you already knew that, right...?</p>
<img src="https://shkspr.mobi/blog/wp-content/themes/edent-wordpress-theme/info/okgo.php?ID=43028&HTTP_REFERER=RSS" alt="" width="1" height="1" loading="eager">]]></content:encoded>
					
					<wfw:commentRss>https://shkspr.mobi/blog/2022/07/dns-esoterica-why-you-cant-dig-switzerland/feed/</wfw:commentRss>
			<slash:comments>23</slash:comments>
		
		
			</item>
	</channel>
</rss>
