Communications error with deSEC services

That is a misunderstanding of the purpose of the MNAME in the SOA record. It is defined as the primary source of the DNS data, but it is not necessarily a public server. The NS resource record set lists the servers that are to be queried. Not making the MNAME available as a public server is called “hidden primary”. It is an allowed and frequently used configuration, which means it is wrong to query the MNAME from the SOA record. If the MNAME is to be used as a public server, it is also listed in the NS RR set. The only purpose of the MNAME is for RFC2136 style dynamic DNS updates.

(This has come up before.)

3 Likes