6

I've recently been noticing some "odd" behavior from my ISP's DNS server when resolving non-existent domain. It's been causing me some problems and I was wondering if these DNS servers are actually conforming to the standard.

It started with them adding the feature that if you request an incorrect domain, it directs you to a search page that they run. I guess this is useful for some people when web browsing, but it borks things up for other applications particularly if the search server has some other open ports such as SMTP.

To get round this, I changed preferences with my ISP to turn this feature off. Now my ISP's DNS does something lot stranger. When a domain can not be found, it returns MY own IP address as the A name for that non-existent domain. So now if I click a link which no-longer exists, it bounces me to my own home page (run through the same Internet connection).

I'm trying to understand why being bounced to my own IP address would ever be useful. More to the point, is this the standard or are they breaking the standard for some purpose best known to themselves?

1

4 Answers 4

9

Yes, your ISP is breaking the standard, but it is a common occurrence these days. Your ISP's DNS servers should be returning a NXDOMAIN response, or "Non-existent Domain".

If they are unable to do this, I would look at using external DNS servers like Google or OpenDNS, or running your own internal caching/resolving servers for your clients.

A note on OpenDNS, I believe you have to sign up for a business account to turn off NXDOMAIN redirection.

2
  • 3
    You can run your on resolver starting at root just like the big boys do - then you can return the correct NXDOMAIN to your services and do the right thing. Pretty easy to do if you're technologically competent otherwise you might try someone like dyn.com who for not much money will give you a clean DNS resolver (meaning conforming to best practices).
    – Ram
    Mar 26, 2012 at 21:38
  • 1
    This behavior is also known as "NXDOMAIN Hijacking" - a veritable scumbag move. Mar 28, 2015 at 1:54
2

No. You should get NXDOMAIN ( http://dnsknowledge.com/whatis/nxdomain-non-existent-domain-2/ ) when a domain does not exists in authoritative dns server. An example:

host foooo.serverfault.com
Host foooo.serverfault.com not found: 3(NXDOMAIN)

Google does return NXDOMAIN

 host foooo.serverfault.com 8.8.8.8
 Using domain server:
 Name: 8.8.8.8
 Address: 8.8.8.8#53
 Aliases: 

 Host foooo.serverfault.com not found: 3(NXDOMAIN)

Have you tried using your own DNS server (BIND caching dns server)? The best way to track this issue is to run dig command or better use the tcpdump command. The following will trace the delegation path from the root name servers to verify that you are getting correct data from your own authoritative dns servers:

 dig +trace your.domain.com
1

I am not sure what the RFC is regarding this. However Window DNS returns a timeout.

> yagoo.mil
Server:  mylocaldc.com
Address:  172.27.27.10

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to mylocaldc.com timed-out

However google returns the Domain name back with no answer.

> server 8.8.8.8
Default Server:  google-public-dns-a.google.com
Address:  8.8.8.8

> yagoo.mil
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    yagoo.mil
2
  • 1
    The .mil nameservers are strange and don't seem to like returning authoritative NXDOMAIN responses. If you try a nonsense .com address (or a nonsense TLD like foo.z9pp), you should get something other than a timeout. Mar 26, 2012 at 22:07
  • @DavidSchwartz Yes, I've noticed that too, been curious, almost forgot about it. Also, I lol'd a little at yagoo ;) Mar 26, 2012 at 23:12
1

That's ... wait, what?

You really should be getting NXDOMAIN for any domain that doesn't exist.

Wildcard results on domains that don't exist are a reality these days - unfortunate as that may be. But returning the requesting IP as a wildcard... that doesn't make any sense. I've also never seen Google do anything like that.

Do you have the output of dig or nslookup that you can share to clarify what's going on?

Alternatively, are you willing to share the IP of your ISP's DNS server, or perhaps their name? I'd love to see this in action, because it makes no sense at all. I can't think of any reason why the behavior you're describing would exist.

1
  • Okay. Naming it as a wild card got me thinking, there IS a wild card on my own domain. It's not really used, so I've moved it to point at something else... The fault followed my own wild card. This mean's the fault is coming from my own kit. Will dig into this further. Mar 26, 2012 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .