Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way I can trace a DNS request to see where the answer is coming from?

Our network has internal DNS servers that provide internal IP address resolution, and we use EasyDNS to host our public-facing DNS.

The situation is that EasyDNS is set up correctly for a certain address with its external IP, but when I do a dig from within our network, I get the (correct) internal IP - but the domain does not appear to be set up on any of our internal DNS servers. Our primary DNS server (Active Directory) lists the domain as cached, but doesn't say from where.

How can I trace where dig is getting its results from?

share|improve this question
2  
Are you using NAT routing? Some NAT routers will inspect DNS packets and translate known external IPs that it handles and convert them to the internal IP addresses in the response before forwarding the packet along the network. –  Justin Scott May 1 '09 at 21:14
    
Thank you - I think this is EXACTLY what was happening. Unfortunately I can't ACCEPT a comment as the answer (write it again as an answer and I'll accept it) –  Brent May 1 '09 at 21:42

2 Answers 2

If using dig:

dig +trace ....

otherwise, run Wireshark to capture the packets.

share|improve this answer
    
As soon as I add +trace, dig resolves the EXTERNAL ip address instead of the internal - remove +trace and I get INTERNAL ip address again! –  Brent May 1 '09 at 16:44
    
that's, umm, odd... is that dig running on Windows or UNIX? –  Alnitak May 1 '09 at 16:48
    
linux - tried from a couple linux machines. –  Brent May 1 '09 at 16:52
    
ok, that's really odd, then. adding +trace to the query only enables local debugging, it doesn't change the query sent to the server. –  Alnitak May 1 '09 at 17:09
    
@Alnaitak +trace tells dig to resolve the query from first principals. From the man page "When tracing is enabled, dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup." –  Dave Cheney May 5 '09 at 16:48
up vote 1 down vote accepted

I'm quoting Justin Scott's answer, because I'm pretty sure he was right:

Are you using NAT routing? Some NAT routers will inspect DNS packets and translate known external IPs that it handles and convert them to the internal IP addresses in the response before forwarding the packet along the network.

share|improve this answer
    
Appliances such as Cisco ASA firewall devices also do this. They call it DNS doctoring. –  Martijn Heemels Feb 16 '10 at 8:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.