Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using nslookup and trying to figure out the difference in authoritative and non-authoritative responses. These two responses seem to be consistent (they give the same answer if you run the command multiple times).

Normal nslookup call

$ nslookup google.com
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   google.com
Address: 72.14.213.104
Name:   google.com
Address: 72.14.213.105
Name:   google.com
Address: 72.14.213.106
Name:   google.com
Address: 72.14.213.147
Name:   google.com
Address: 72.14.213.99
Name:   google.com
Address: 72.14.213.103

Nslookup using google's authoritative server

$ nslookup google.com ns1.google.com
Server:         ns1.google.com
Address:        216.239.32.10#53

Name:   google.com
Address: 74.125.225.19
Name:   google.com
Address: 74.125.225.20
Name:   google.com
Address: 74.125.225.16
Name:   google.com
Address: 74.125.225.17
Name:   google.com
Address: 74.125.225.18

Any idea why these are different? Should these be giving different responses?

When I ping google.com, it shows 72.14.213.104 and the RTT is 1/3 of the RTT for pinging 74.125.225.19.

Can anyone explain this?

share|improve this question
add comment

4 Answers

Google attempts to return the IPs of servers closest to the requester. In the first case your name server is making the request. In the second case your PC is making the request.

The authoritative vs. non-authoritative information has nothing to do with it.

share|improve this answer
    
Yeah that makes sense. I guess that was mostly an aside. I'm more curious about the difference in nslookup responses. –  mouche Apr 4 '11 at 20:03
add comment
  1. A reply labelled 'Non-authoritative' is just the nameserver letting you know that the result wasn't uniquely retrieved for your request and was cached as part of a previous request (for you or another client). Also, since your first example hits 192.168.1.1 and not your ISP's nameserver directly, your router may also be implementing another layer of caching.
  2. Google.com is served by thousands upon thousands of servers in hundreds of different data centers. Their DNS server is trying to provide you with a geo-targeted address. There's no guarantee it'll be the server that's got lowest latency, highest throughput or host capable of the fastest response, just a best-guess likely taking all three into account. Also, since ns1.google.com is not designed as a customer-facing DNS nameserver (like your ISP's DNS or Google Public DNS) who knows the logic is uses when replying to your requests.

Basically, unless you've got odd network connectivity (high latency/low throughput/high packet loss) or DNS responses are wicked slow from your ISP, I'd suggest you not micromanage DNS, it's just not worth the effort. And in this case, ISPs DNS server provided you with the better (best?) result anyways.

share|improve this answer
    
Thanks for the thorough response. I didn't realize ns1.google.com was not designed as customer-facing. But other non-authoritative DNS servers ultimately get the DNS records from the authoritative servers? It seems like the responses from non-authoritative and authoritative should agree in general. –  mouche Apr 4 '11 at 20:18
add comment

Wikipedia entry on DNS explains it quite well :

An authoritative name server is a name server that gives answers that have been configured by an original source, for example, the domain administrator or by dynamic DNS methods, in contrast to answers that were obtained via a regular DNS query to another name server.

Regarding the ping difference, it's like if you were saying "When I go to Washington DC from New York, it only takes a tenth of the time it takes to go to Portland". The addresses are not remotely the same, so they can be far from each other.

This applies for both IP addresses and geographical addresses.

share|improve this answer
add comment

An authoritative answer should come directly from a one the name servers for the domain. Non-authoritative answer can come from any server which has an answer. Unless the configuration has been recently changes the answers will be the same.

Requests can specify that they require an authoritative answer. These may require additional lookups as an authoritative server must be contacted. When changes are being made it is possible to get differing answers from different authoritative servers. The answer with the highest serial number should be the most recent answer. (In rare cases where the serial number is being reset, this is not the case.)

Non-authoritative answers should be answered by the first server contacted which has an answer. This is the fastest possible response. These answers are sufficient for most uses.

Services like Google are a special case. They use special servers which provide different answers depending on your location. They may also do load balancing. Both of these will result in different answers over time. Cached (non-authoritative) answers will likely be older and reflect the preferred servers at the time the result was cached.

Google tries to direct you to servers which have the best connectivity to your location. These servers should have lower RTTs than other Google servers at other locations.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.