Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If I do an nslookup on, no problem, if I do one with, failure. See details below.

[~] nslookup



Non-authoritative answer:







[~] nslookup

;; Truncated, retrying in TCP mode.

;; Connection to for failed: connection refused.

If I do the same from a Windows machine its fine, its when I do it from a Mac workstation that I get the issue.

I have rebooted, both server and workstation, I did a changeip, but nothing is working.

Any recommendations?

share|improve this question

2 Answers 2

up vote -1 down vote accepted

Just turn IPv6 off, it should work then :)

share|improve this answer isn't advertising any IPv6 addresses, how would this help? –  sysadmin1138 Apr 4 '11 at 14:21
I went to system preferences, Network, and turned off ipv6 and everything works now!!! Thank you I had given up. This is so uncool, I cannot raise the grade on this answer since I dont have enough reputation. This is THE CORRECT ANSWER, ignore the other one. Note I did this on the Mac Mini server. –  Eric Arseneau Apr 5 '11 at 4:36

For some reason the osx workstation is issuing UDP dns requests and the reply was too big to fit into a UDP packet (hence it was truncated). The dns resolver on the osx machine is turning around and trying to issue the same request using tcp (which it should have in the first place). THEN something is preventing the osx machine from contacting the dns server using a tcp socket on port 53. Do a tcpdump and watch for icmp messages, specifically "Administratively blocked" messages which generally are hawked back from a fw or nacl when it blocks a connection.

That would be a start. Also, run dig instead of nslookup.

share|improve this answer
dig results in exactly the same result for the case. –  Eric Arseneau Mar 17 '11 at 23:29
Oh yeah, if I do a dig +ignore, it works fine as well. I think it is a UDP packet size issue, but how do I get to the bottom of it :( –  Eric Arseneau Mar 17 '11 at 23:41
Keep in mind that Directory Services doesn't use the same code dig and nslookup do, which is the ISC standard way of doing it (that doesn't mean it's the best way, just that that's how it works with ISC's BIND utilities everywhere.) It's probably doing something similar, but not absolutely certain. As to the TCP failure, the OP's router is handling DNS (see the address it's querying: and doesn't support TCP DNS. The fix for that is to override DNS in Control Panel > Internet & Wireless > Network. –  geekosaur Mar 17 '11 at 23:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.