AA flag

The Authoritative Answer bit a DNS server sets when it answers from a zone it serves, printed as aa by dig.

Its absence is what nslookup reports as Non-authoritative answer. The line alarms people for no reason: a resolver answering from its cache, or fetching the answer on your behalf, leaves the bit clear, and that is how an ordinary recursive lookup is meant to work.

RFC 1035 says AA is valid in responses and means the responding server is an authority for the name in the question section. When the answer follows an alias, it covers only the first name: RFC 2181 warns that the other records may have come from the server's cache. A clear bit says only that the server is not an authority, so a cache hit, a freshly fetched recursive answer and a referral all look alike.

To see an authoritative answer, ask one of the zone's name servers directly with recursion off, for example dig @ns.example.com example.com +norecurse, and look for aa on the flags line. The TTL is then the zone's constant value, where a cached copy counts down on every repeat.

AA records where the data came from, not whether it is right. RFC 9499 counts a server that answers without the authoritative bit for a zone delegated to it among the flaws called lame delegation. And RFC 6604 notes that DNSSEC does not protect the AA bit, so only validation authenticates the data.

Also known as: aa bit, authoritative answer, authoritative answer bit, non-authoritative answer

Sources

← All glossary entries