Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my VPSs with LeaseWeb, whenever I reach an non-existent host, I get domain name, and if I ping a non-existent domain from SSH, I don't get "host not found" but replies from IPs like these:

My host is doing something, what exactly? Can I disable this?

It looks like fetches all traffic to nonexistent domains, must have some advertising deal with my host maybe ?!

It messes up my mail server, sending emails even if host doesn't really exist, then gets jammed with bounces from

I am also waiting for a reply from my host but I want to know what you think.

share|improve this question
One resolution I can think of would be to change the DNS servers that your server uses. Are you contractually or technically bound to using the DNS servers that LeaseWeb provides? – joeqwerty Oct 6 '11 at 23:06
I don't think I am. But... how do I pick the right (reliable) DNS to use? – adrianTNT Oct 6 '11 at 23:10
Well, I would probably use Google's public DNS servers. If you don't have an internal DNS server and don't need one, then I don't see any reason you can't switch to using Google's or someone else's. – joeqwerty Oct 6 '11 at 23:13
In /etc/resolv.conf an entry "search com" had to be removed. – adrianTNT Oct 7 '11 at 0:29
up vote 13 down vote accepted

Sounds like NXDOMAIN hijacking.

What DNS servers is your device using, and can you change them to a non-hijacking recursive lookup server?

share|improve this answer
In /etc/resolv.conf I had and, but after these it was "search com" while on other servers was "search localdomain", the "search com" probably caused the problem. – adrianTNT Oct 7 '11 at 0:29
Those belong to leaseweb. As @up_the_irons suggested, Google's public DNS servers are well-behaved and generally very fast, give them a try. – Shane Madden Oct 7 '11 at 0:31

Sounds like NXDOMAIN hijacking to me as well.

Replace the name servers in your /etc/resolv.conf and use Google's instead: and

share|improve this answer
Thanks. Wow, Google has some cool IPs :D – adrianTNT Oct 7 '11 at 0:37
Indeed, Level3 assigned to Google on 2009-09-21. Level3 controls the entire class A block. – up_the_irons Oct 7 '11 at 0:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.