behavior for cpfoo.com/NS query

[Felipe Gasper]

Hello,

	I’ve noticed that unbound (1.9.3, built from source) indicates SERVFAIL in response to a cpfoo.com/NS query. (unbound-host -t NS cpfoo.com)

	This same query returns a result from `dig +trace`.

	Apparently unbound is doing:

./NS           - to the root servers
com./A         - to the root servers
cpfoo.com./A   - to *.gtld-servers.net
cpfoo.com./NS  - to cpfoo.com -> SERVFAIL

	Putting aside why cpfoo.com is giving SERVFAIL, why does unbound ask the server itself what its authoritative nameserver is? Wouldn’t *.gtld-servers.net be where that query should go?

	Thank you!

-Felipe Gasper
Mississauga, Ontario