[Pdns-users] SERVFAIL on possibly broken zone supersport.co.za

[Sven Ulland]

Summary: PowerDNS recursor 3.3 returns SERVFAIL when looking up
the A record of images.supersport.co.za due to not following the final
glue records, while BIND 9.8.1 returns the correct A record after
following the glue. Which is right, what is broken?

Skipping root, .za and .co.za NS steps. Also, recursion must be
explicitly disabled, since their NS actually recurses.

dig +norecurse @ns0.is.co.za a images.supersport.co.za
  ;; AUTHORITY SECTION:
  supersport.co.za.      86400   IN  NS  ns1.mwebhosting.net.
  supersport.co.za.      86400   IN  NS  ns2.mwebhosting.net.

dig +norecurse @ns1.mwebhosting.net a images.supersport.co.za
  ;; AUTHORITY SECTION:
  images.supersport.co.za. 600   IN  NS images.supersport.co.za.

  ;; ADDITIONAL SECTION:
  images.supersport.co.za. 600   IN  A  196.28.29.130
  images.supersport.co.za. 600   IN  A  196.28.84.130

At this point, PowerDNS seems to stop, and returns SERVFAIL to the
stub resolver. BIND follows the NS+glue, and does:

dig +norecurse @196.28.29.130 a images.supersport.co.za
  ;; ANSWER SECTION:
  images.supersport.co.za. 0     IN  A  196.28.29.148

This gives the final IP that can be connected to on port 80.

So:

1) Why doesn't PowerDNS follow the glue in that last answer?

2) If PowerDNS is doing the right thing, exactly which spec (RFC
    and which section) is the zone (and thus also BIND) violating?

I intend to contact the zone admins about this once I get to the
bottom of it.

Sven