Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my VPSs with LeaseWeb, whenever I reach an non-existent host, I get search.com domain name, and if I ping a non-existent domain from SSH, I don't get "host not found" but replies from IPs like these: phx1-ss-2-lb.cnet.com

My host is doing something, what exactly? Can I disable this?

It looks like search.com fetches all traffic to nonexistent domains, must have some advertising deal with my host maybe ?!

It messes up my mail server, sending emails even if host doesn't really exist, then gets jammed with bounces from @xx.xx.cnet.com

I am also waiting for a reply from my host but I want to know what you think.

share|improve this question
5  
One resolution I can think of would be to change the DNS servers that your server uses. Are you contractually or technically bound to using the DNS servers that LeaseWeb provides? –  joeqwerty Oct 6 '11 at 23:06
    
I don't think I am. But... how do I pick the right (reliable) DNS to use? –  adrianTNT Oct 6 '11 at 23:10
    
Well, I would probably use Google's public DNS servers. If you don't have an internal DNS server and don't need one, then I don't see any reason you can't switch to using Google's or someone else's. –  joeqwerty Oct 6 '11 at 23:13
    
In /etc/resolv.conf an entry "search com" had to be removed. –  adrianTNT Oct 7 '11 at 0:29
add comment

2 Answers

up vote 13 down vote accepted

Sounds like NXDOMAIN hijacking.

What DNS servers is your device using, and can you change them to a non-hijacking recursive lookup server?

share|improve this answer
    
In /etc/resolv.conf I had 62.212.65.123 and 62.212.64.122, but after these it was "search com" while on other servers was "search localdomain", the "search com" probably caused the problem. –  adrianTNT Oct 7 '11 at 0:29
    
Those belong to leaseweb. As @up_the_irons suggested, Google's public DNS servers are well-behaved and generally very fast, give them a try. –  Shane Madden Oct 7 '11 at 0:31
add comment

Sounds like NXDOMAIN hijacking to me as well.

Replace the name servers in your /etc/resolv.conf and use Google's instead:

8.8.8.8 and 8.8.4.4

share|improve this answer
    
Thanks. Wow, Google has some cool IPs :D –  adrianTNT Oct 7 '11 at 0:37
    
Indeed, Level3 assigned 8.8.8.0/24 to Google on 2009-09-21. Level3 controls the entire 8.0.0.0/8 class A block. –  up_the_irons Oct 7 '11 at 0:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.