Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got three different IP addresses when trying to resolve a domain name three times. All three of these pings happened within seconds of one another. Is this normal? I wouldn't think DNS servers could be updated so quickly, so my guess is that this is something to do with load-balancing.

So far, I've only noticed this with, and I tried it because a friend was reporting that he was redirected to Best Buy Turkey, and Best Buy Korea when visiting last night.


Pinging [] with 32 bytes of data:...


Pinging [] with 32 bytes of data:...


Pinging [] with 32 bytes of data:...
share|improve this question

migrated from Aug 14 '10 at 16:37

This question came from our site for professional and enthusiast programmers.

probably better for ServerFault. – James Aug 13 '10 at 17:52
Noted. Sorry about posting in the wrong forum, but thanks for the replies, Guys. – Mike M. Lin Aug 13 '10 at 18:15
up vote 5 down vote accepted

(Probably a better question for serverfault, but...)

If you do an nslookup on

localhost /home/me > nslookup
Default Server:


Non-authoritative answer:


Note that there are multiple ip addresses that correspond to this ip name. The primary purpose of this is to provide a failover. If one of their web farms goes DOA, then the other will continue to accept inbound traffic. The positive side effect of this is that when everything is operating normally, they can share the traffic load between two farms.

share|improve this answer

Wrong site for this question, but my guess is load balancing

share|improve this answer

The reason for this is because the zonefile for the zone contains multiple A records for the entry @ eg:

@                IN        A
@                IN        A 

This is done for load balancing purposes.

share|improve this answer

Look at dig:

# dig

; <<>> DiG 9.5.0-P2.1 <<>>
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 395
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;                   IN      A

;; ANSWER SECTION:            20      IN      A            20      IN      A

;; Query time: 52 msec
;; WHEN: Sat Aug 14 14:26:35 2010
;; MSG SIZE  rcvd: 61

As pointed above, they do it for load balancing, fail over, etc... But it's a pretty unsafe way of doing it because DNS load balancing works close to round robin: every time you ask for a hostname, the DNS server answers with one of the pool (like you see happening in your ping). Unfortunately, it means that in case of one of the "servers" goes down, half of the requests will fail.

It's better to implement that using a true load balancer, or a VIP (virtual ip).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.