I have two different FreeBSD servers (different hosting companies), both exhibit this same behavior: They pick a specific IP address (18.104.22.168) for every domain that does NOT exist.
nslookup fails as it should....
$ nslookup thisdomainsurelydoesntexist.com Server: xx.xx.229.3 Address: xx.xx.229.3#53 ** server can't find thisdomainsurelydoesntexist.com: NXDOMAIN
dig gives me:
$ dig thisdomainsurelydoesntexist.com ; <<>> DiG 9.6.-ESV-R5-P1 <<>> thisdomainsurelydoesntexist.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51717 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;thisdomainsurelydoesntexist.com. IN A ;; AUTHORITY SECTION: com. 900 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1370378827 1800 900 604800 86400 ;; Query time: 23 msec ;; SERVER: xx.xx.229.3#53(xx.xx.229.3) ;; WHEN: Tue Jun 4 16:05:02 2013 ;; MSG SIZE rcvd: 122
and ping gives me:
$ ping thisdomainsurelydoesntexist.com PING phx2-ss-5-bug616849-lb.cnet.com (22.214.171.124): 56 data bytes 64 bytes from 126.96.36.199: icmp_seq=0 ttl=244 time=25.733 ms 64 bytes from 188.8.131.52: icmp_seq=1 ttl=244 time=20.460 ms ^C --- phx2-ss-5-bug616849-lb.cnet.com ping statistics --- 2 packets transmitted, 2 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 20.460/23.096/25.733/2.637 ms
Note that dig's final host name, nstld.verisign-grs.com, resolves to that IP.
What's the fix?
UPDATE: /etc/resolv.conf has two nameserver rows, each with an IP(v4) I got from my ISP.
But if I add a "search" row to resolv.conf, behavior changes: if "search mydomain.com" (i.e., my real domain name), everything resolves to it and I get my own IP. E.g., thisdomainsurelydoesntexist.com.mydomain.com. Not good. But if I set it to something else, like "search myispdomain.com", then everything works: existing domains resolve, and nonexistent ones don't.
But is that anything but an accident?
Thanks for the suggestions! Here's host -a, and the xx.xx.80.18 IP is the first nameserver in /etc/resolv.conf
$ host -a thisdomainsurelydoesntexist.com Trying "thisdomainsurelydoesntexist.com" Received 122 bytes from xx.xx.80.18#53 in 13 ms Trying "thisdomainsurelydoesntexist.com" Host thisdomainsurelydoesntexist.com not found: 3(NXDOMAIN) Received 122 bytes from xx.xx.80.18#53 in 0 ms
My ISP just told me it could be because my hostname is of the form "mydomain.com" instead of "myhost.mydomain.com" (which is their recommended practice). I could see how that might fix it. Is that the thing to do? No downsides to it?
Also, very significantly, I should mention that this python code works the same way ping does:
import _socket _socket.getaddrinfo('thisdomainsurelydoesntexist.com', 80)
And many other python modules are built on this core.