Chapter 55 — DNS operations: authoritative DNS, delegation, split-horizon, outages

Build it in Go (25 min) — compare resolvers in one command

Most DNS incidents come down to "different resolvers give different answers". This program asks several resolvers at once, groups identical answers, and flags disagreement:

// dnsdiff: ask several resolvers the same question and show where the answers
// disagree -- split-horizon, stale caches, half-finished migrations, and
// "works for me" incidents (Chapter 55).
//
//	go run ./dnsdiff www.github.com
//	go run ./dnsdiff -servers system,1.1.1.1,8.8.8.8,9.9.9.9 api.example.com
package main

import (
	"context"
	"flag"
	"fmt"
	"net"
	"os"
	"slices"
	"strings"
	"sync"
	"time"
)

func main() {
	servers := flag.String("servers", "system,1.1.1.1,8.8.8.8,9.9.9.9", "comma-separated resolvers; 'system' = your OS config")
	flag.Parse()
	if flag.NArg() != 1 {
		fmt.Println("usage: dnsdiff [-servers a,b,c] name")
		os.Exit(2)
	}
	name := flag.Arg(0)
	list := strings.Split(*servers, ",")

	type answer struct {
		addrs []string
		took  time.Duration
		err   error
	}
	answers := make([]answer, len(list))
	var wg sync.WaitGroup
	for i, s := range list {
		wg.Add(1)
		go func() {
			defer wg.Done()
			ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
			defer cancel()
			start := time.Now()
			addrs, err := resolverFor(s).LookupHost(ctx, name)
			slices.Sort(addrs)
			answers[i] = answer{addrs, time.Since(start), err}
		}()
	}
	wg.Wait()

	groups := map[string][]string{} // identical answer sets -> which resolvers gave them
	for i, a := range answers {
		key := strings.Join(a.addrs, " ")
		if a.err != nil {
			key = "ERROR: " + a.err.Error()
		}
		groups[key] = append(groups[key], list[i])
		fmt.Printf("%-10s %-8v %s\n", list[i], a.took.Round(time.Millisecond), key)
	}
	if len(groups) == 1 {
		fmt.Println("\nall resolvers agree")
		return
	}
	fmt.Printf("\n%d different answers. Possible reasons: split-horizon DNS, a record changed\n", len(groups))
	fmt.Println("within the TTL (caches disagree), GeoDNS/CDN steering, or a broken resolver.")
}

// resolverFor returns a Go resolver that sends every query to one server.
// PreferGo uses Go's own DNS client, so the Dial hook decides the server.
func resolverFor(server string) *net.Resolver {
	if server == "system" {
		return net.DefaultResolver
	}
	return &net.Resolver{
		PreferGo: true,
		Dial: func(ctx context.Context, network, _ string) (net.Conn, error) {
			var d net.Dialer
			return d.DialContext(ctx, network, net.JoinHostPort(server, "53"))
		},
	}
}

$ go run ./dnsdiff www.github.com
system     94ms     20.207.73.82
1.1.1.1    81ms     20.207.73.82
8.8.8.8    80ms     20.207.73.82
9.9.9.9    81ms     20.205.243.166

2 different answers. Possible reasons: split-horizon DNS, a record changed
within the TTL (caches disagree), GeoDNS/CDN steering, or a broken resolver.

That disagreement is real and harmless: GitHub steers clients by location, and Quad9's resolver egresses from a different region. During a migration, the same output shows you exactly which caches still hold the old address.

What to notice: net.Resolver{PreferGo: true, Dial: ...} makes Go use its own DNS client and send every query to the server you choose. The same Dial hook is how you'd run DNS over TCP or through a SOCKS proxy.

Exercises:

1. Add your company's internal resolver to -servers and query an internal name from inside and outside the VPN. You've just mapped your split horizon.
2. Add an authoritative mode: look up the zone's NS records, then query each authoritative server directly. All of them should return the same SOA serial. If they don't, a secondary is behind.
3. During your next DNS change, run it in a loop every 30 s and log when each resolver switches. Compare that with the TTL you set.