DNS is different for domain when http:// is used

Question

I'm using the Linux tool dig to see the DNS records for my website. When I type in

dig www.aaaaaaa.com

it returns one IP address and when I get one IP and when I type in

dig http://www.aaaaaaa.com

it gives me a different IP.

Why would http:// make a different to the DNS record being returned?

I should mention I'm using AWS Route53 so that US IP addresses go to a US server and other IP addresses go to the main server.

Answer 1

This could be possible if you setup a wildcard DNS record like:

*.aaaaaaa.com IN A 1.2.3.4 

And configured a different record for www.aaaaaaa.com.

Needless to say, you shouldn't add http:// to the DNS query since this is not part of the hostname.
No normal client would do that.

Answer 2

Hostnames with a http:// prefix are illegal, as are all hostnames with a protocol prefix. Most resolvers would return NXDOMAIN in this case, however, many ISPs and others return their own IPs in place of NXDOMAIN responses such as OpenDNS:

$ host http://www.aaaaaaa.com 208.67.222.222
Using domain server:
Name: 208.67.222.222
Address: 208.67.222.222#53
Aliases: 

http://www.aaaaaaa.com has address 67.215.65.132
Host http://www.aaaaaaa.com not found: 3(NXDOMAIN)

See how it says "http://www.aaaaaaa.com has address 67.215.65.132" -- that's a lie. That IP goes to OpenDNS' landing page where they show you ads.

Answer 3

I did see the behaviour you describe but it looks like whatever was causing this to happen has been 'fixed' as

 dig  http://www.ecanvasser.com

now (correctly) returns NXDOMAIN.

FWIW I had the same IP address returned for both (I'm in the UK and was directed to ie...).

---

My initial thoughts (which are moot now) were that it was being handled as a wildcard entry but the : and / aren't valid characters for hostnames so whatever it was, was going an extra mile to be helpful.

Answer 4

Are you sure you are getting a responce

I may be mistaken but dig command is used in this way, without http:// or www.

#dig google.com

; <<>> DiG 9.9.5-2-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63957
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 4, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     254 IN  A   173.194.113.65
google.com.     254 IN  A   173.194.113.66
google.com.     254 IN  A   173.194.113.67
google.com.     254 IN  A   173.194.113.68
google.com.     254 IN  A   173.194.113.69
google.com.     254 IN  A   173.194.113.70
google.com.     254 IN  A   173.194.113.71
google.com.     254 IN  A   173.194.113.72
google.com.     254 IN  A   173.194.113.73
google.com.     254 IN  A   173.194.113.78
google.com.     254 IN  A   173.194.113.64

;; AUTHORITY SECTION:
google.com.     53642   IN  NS  ns3.google.com.
google.com.     53642   IN  NS  ns1.google.com.
google.com.     53642   IN  NS  ns4.google.com.
google.com.     53642   IN  NS  ns2.google.com.

;; ADDITIONAL SECTION:
ns1.google.com.     226442  IN  A   216.239.32.10
ns2.google.com.     226442  IN  A   216.239.34.10
ns3.google.com.     226666  IN  A   216.239.36.10
ns4.google.com.     226666  IN  A   216.239.38.10

;; Query time: 14 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Sun Mar 23 18:55:55 EET 2014
;; MSG SIZE  rcvd: 351