Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an intermittent problem, and I'm not sure where to start trying to troubleshoot it.

In our dev environment, we have two visible IP addresses on load balancers, one to the front-end, and one to a number of back-end service machines. The front-end is configured to take a wildcard DNS name to support generic "portals."   A

The back-end servers are all specific names within the same space:   A    CNAME CNAME

Here's the problem. Periodically a developer or a program trying to reach, say, will get a result that points to the front-end, instead of the back-end load balancer: is an alias to is an alias to (WRONG!)

The developers are all on Mac OS X machines, though I've seen the problem occur on an Ubuntu machine as well, using a local cloud host DNS resolver.

Sometimes the developer is using a VPN, which directs the DNS to its own resolver, and sometimes he's on the local net using a DNS resolver assigned by the NAT router.

Sometimes clearing the Mac OS X DNS cache, logging into the VPN, then logging out of the VPN, will make the problem go away.

The origin authoritative server is on zerigo, and a dig directly to their name servers always seems to give the correct answer. The published DNS cache time for these records is 15 minutes, but the problem has been intermittent for about a week.

Any troubleshooting suggestions?

share|improve this question
Shouldn't there be periods at the end of all FQDNs listed in your example? – mdpc Oct 18 '12 at 19:29
Yes, if it were a bind named config file, but they're managed on Zerigo, so they take care of that. – Mojo Oct 18 '12 at 22:05
up vote 0 down vote accepted

Hmmm....what happens when you replace the wildcard CNAME directive with:

 *    A
share|improve this answer
I tried that early on, trying to use no CNAMEs, to no effect. – Mojo Oct 18 '12 at 22:06
I take it back. Changing everything to A records does solve the problem. I'll elaborate, but give you credit for the answer. – Mojo Oct 22 '12 at 16:37

Don't mix CNAMEs with wildcards, especially if one of your CNAMES might match a wildcard name.

It appears that the mix of wildcards, CNAMEs and DNS cacheing can give you inconsistent results under these conditions.

I solved my intermittent resolving problems by eliminating all of the CNAMEs and replacing them with A records. Not very DRY, but no more inconsistent lookups.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.