When running an undelegated test on a root zone using zonemaster-cli with one or more --ns options, the root hints (either the built-in ones or loaded from a different file with the --hints option) are not properly overridden.
In other words, the undelegated data for root zones do not replace the root hints, but merely add to them.
The following command-line output illustrates this well:
$ zonemaster-cli --raw --test delegation01 --level info . --ns ns1/127.1.0.1 --ns ns1/fda1:b2:c3:0:127:1:0:1 --ns ns2/127.1.0.2 --ns ns2/fda1:b2:c3:0:127:1:0:2
0.00 INFO GLOBAL_VERSION version=v9.0.0
0.00 INFO ENOUGH_NS_DEL count=2; minimum=2; nsname_list=ns1;ns2
0.01 INFO ENOUGH_NS_CHILD count=2; minimum=2; nsname_list=ns1;ns2
0.01 INFO ENOUGH_IPV4_NS_CHILD count=15; minimum=2; ns_list=a.root-servers.net/198.41.0.4;b.root-servers.net/170.247.170.2;c.root-servers.net/192.33.4.12;d.root-servers.net/199.7.91.13;e.root-servers.net/192.203.230.10;f.root-servers.net/192.5.5.241;g.root-servers.net/192.112.36.4;h.root-servers.net/198.97.190.53;i.root-servers.net/192.36.148.17;j.root-servers.net/192.58.128.30;k.root-servers.net/193.0.14.129;l.root-servers.net/199.7.83.42;m.root-servers.net/202.12.27.33;ns1/127.1.0.1;ns2/127.1.0.2
0.01 INFO ENOUGH_IPV6_NS_CHILD count=15; minimum=2; ns_list=a.root-servers.net/2001:503:ba3e::2:30;b.root-servers.net/2801:1b8:10::b;c.root-servers.net/2001:500:2::c;d.root-servers.net/2001:500:2d::d;e.root-servers.net/2001:500:a8::e;f.root-servers.net/2001:500:2f::f;g.root-servers.net/2001:500:12::d0d;h.root-servers.net/2001:500:1::53;i.root-servers.net/2001:7fe::53;j.root-servers.net/2001:503:c27::2:30;k.root-servers.net/2001:7fd::1;l.root-servers.net/2001:500:9f::42;m.root-servers.net/2001:dc3::35;ns1/fda1:b2:c3:0:127:1:0:1;ns2/fda1:b2:c3:0:127:1:0:2
0.01 INFO ENOUGH_IPV4_NS_DEL count=2; minimum=2; ns_list=ns1/127.1.0.1;ns2/127.1.0.2
0.01 INFO ENOUGH_IPV6_NS_DEL count=2; minimum=2; ns_list=ns1/fda1:b2:c3:0:127:1:0:1;ns2/fda1:b2:c3:0:127:1:0:2
None of those [a-m].root-servers.net should appear in the ENOUGH_IPV4_NS_CHILD and ENOUGH_IPV6_NS_CHILD, because the root zone being tested names the root servers ns1 and ns2, as evidenced by the following excerpt of the zone file:
$ORIGIN .
$TTL 3600
@ SOA ns1. admin.xb. (
2022112300 ; serial
6h ; refresh
1h ; retry
1w ; expire
1d ) ; minimum
NS ns1.
NS ns2.
ns1. A 127.1.0.1
ns1. AAAA fda1:b2:c3::127:1:0:1
ns2. A 127.1.0.2
ns2. AAAA fda1:b2:c3::127:1:0:2
When running an undelegated test on a root zone using
zonemaster-cliwith one or more--nsoptions, the root hints (either the built-in ones or loaded from a different file with the--hintsoption) are not properly overridden.In other words, the undelegated data for root zones do not replace the root hints, but merely add to them.
The following command-line output illustrates this well:
None of those
[a-m].root-servers.netshould appear in theENOUGH_IPV4_NS_CHILDandENOUGH_IPV6_NS_CHILD, because the root zone being tested names the root serversns1andns2, as evidenced by the following excerpt of the zone file: