Posted on Dec 18, 2024

Explaining DNS NXDOMAIN status in SOA Record Type: On Non-Existing Domains

The aim of this page📝 is to explain DNS querying and filtering using jq and doggo. This is Today I Learned (TIL) about DNS (for an advanced intro New talk: Learning DNS in 10 years is just amazing!). Sharing a bit of tools I use to do that in a few lines of bash (doggo + jq).

I received an alert indicating that a domain, created for the generation of first-party cookies, stopped resolving DNS. This caused an alert and brought me to this task to monitor the health of the customer domain space.
We often need to check domain records, such as A and SOA records.
jq is a lightweight, flexible command-line JSON processor. which is great, see https://news.ycombinator.com/item?id=28266193
doggo is a command-line DNS client used for querying DNS records, see Show HN: Doggo – A powerful, human-friendly DNS client for the command line | Hacker News
The aim is to filter domains that do not have an A record but have SOA and NXDOMAIN responses.
NXDOMAIN indicates a non-existent domain.
SOA (Start of Authority) records contain administrative information about the domain.
Domains are listed in domains_to_check.txt.

for domain in $(cat domains_to_check.txt); do # Perform a DNS query for A records using doggo a_record=$(doggo "$domain" A --short) # Check if the A record is empty if [ -z "$a_record" ]; then # If no A record, perform a DNS query and filter for SOA records doggo "$domain" --json | jq -c '{"domain": $input_line, "soa": [.responses[].authorities[]? | select(.type=="SOA")], "status": .status}' --arg input_line "$domain" | jq 'select(.soa != [] and .status == 3)' fi done

Example Non-Existing SOA Record JSON

Here is an example of a JSON response for a non-existing SOA record:

{ "responses": [ { "answers": null, "authorities": [ { "name": "com.au.", "type": "SOA", "class": "IN", "ttl": "1800s", "mname": "q.au.", "rname": "hostmaster.donuts.email", "serial": 1734513429, "refresh": 7200, "retry": 900, "expire": 1209600, "minimum": 3600, "status": "NXDOMAIN", "rtt": "53ms", "nameserver": "8.8.8.8:53" } ] } ] }