Hacker News Reader

Comment by smosher_ | Hacker News Reader

> ANY queries are not widely used by any real world software. We aware of only two programs that issue ANY queries

Does no one at Cloudflare use dig?

I agree that applications shouldn't be issuing ANY queries¹ under normal circumstances but without being able to perform these queries in tools like dig, a lot of sysadmin/support staff time would be wasted. (AXFR isn't a suitable replacement in this situation because it's disabled or restricted practically everywhere these days.)

¹especially qmaild, even when fetching only MX records, the bug linked from the article will appear when there are enough MX records.

View on HN

> Does no one at Cloudflare use dig?

Looks like all the comments critical of Cloudflare's decision have been downvoted! I use ANY with dig (actually usually with nslookup because of my age) when I set up DNS entries and want to check what records my machine can see.

Are you running dig against your recursor or directly against Authoritative server?

Oh. You said you are running nslookup. Most likely you are running it against a recursive server in which case ANY gives you what is in cache. So not what you want.

You can repoint nslookup with the `server` command which I often do when checking/debugging. I'd have to look up how to do the same with dig.

dig @server domain.name.example.net ANY

Unfortunately, as the Firefox ANY saga shows, this is not the case. Many many programmers around the world misunderstand ANY and its limitations.

I don't follow, what exactly is not the case?

Edit: by the way, are you the one downvoting the posts critical of Cloudflare? I noticed you contribute to their repos on GitHub, and I didn't spot any downvotes on comments that are replies to yours.

I guess because firefox made a bad decision that they're fixing, it means none of us can have nice things?

> without being able to perform these queries in tools like dig, a lot of sysadmin/support staff time would be wasted

You don't want to be using ANY queries in dig, anyway, because they already waste support-staff time. They're entirely too prone to tell you what's already in cache, which might not include the record type you wanted. (It'll probably work when talking to an authoritative server, but if you have to learn how to make things work against recursive/caching servers, it doesn't seem worth learning both methods.) If you want A records, ask for A records. If you want AAAA records or MX or TXT records, ask for AAAA or MX or TXT records. If someone else asks for A records, and then you ask for ANY records, you won't see the AAAA records, which can lead to a long wild-goose chase about who isn't supporting IPv6 properly. If someone else cached A, AAAA, and MX records, and you ask for ANY and don't see a TXT record, you can be super confused about why mail is failing a "nonexistent" SPF rule.

dig defaults to A, anyway. BIND's host command defaults to doing three queries, for A, AAAA, and MX.

Your point might have been correct if all you were querying was your recursive resolvers. But the ANY query is most useful with authoritative servers. So you’re wrong; ANY is very useful.

If you ever have reason to query both recursive and authoritative servers, then you need to know that you should avoid ANY for recursive servers, and you need to know how to query the specific record types you care about. So what's the advantage of having ANY around for authoritative ones?

Reply on news.ycombinator.com