Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using the Linux tool dig to see the DNS records for my website. When I type in

dig www.aaaaaaa.com

it returns one IP address and when I get one IP and when I type in

dig http://www.aaaaaaa.com

it gives me a different IP.

Why would http:// make a different to the DNS record being returned?

I should mention I'm using AWS Route53 so that US IP addresses go to a US server and other IP addresses go to the main server.

screenshot

share|improve this question
1  
Please show us the output of the second dig command. –  Iain Mar 23 at 16:58
3  
Don't prefix http:// that's the protocol not your domain and those characters are invalid in DNS. –  Jacob Mar 23 at 20:47

4 Answers 4

This could be possible if you setup a wildcard DNS record like:

*.aaaaaaa.com IN A 1.2.3.4 

And configured a different record for www.aaaaaaa.com.

Needless to say, you shouldn't add http:// to the DNS query since this is not part of the hostname.
No normal client would do that.

share|improve this answer
1  
Most likely. http://www is the label being looked up within the domain, as opposed to www. –  Andrew B Mar 23 at 18:50

Hostnames with a http:// prefix are illegal, as are all hostnames with a protocol prefix. Most resolvers would return NXDOMAIN in this case, however, many ISPs and others return their own IPs in place of NXDOMAIN responses such as OpenDNS:

$ host http://www.aaaaaaa.com 208.67.222.222
Using domain server:
Name: 208.67.222.222
Address: 208.67.222.222#53
Aliases: 

http://www.aaaaaaa.com has address 67.215.65.132
Host http://www.aaaaaaa.com not found: 3(NXDOMAIN)

See how it says "http://www.aaaaaaa.com has address 67.215.65.132" -- that's a lie. That IP goes to OpenDNS' landing page where they show you ads.

share|improve this answer
1  
You might want to read RFC1912 2.1...there is a vast difference between what characters are legal in a label, what legalities are required to be enforced by implementations, and what characters are illegal for a hostname (which is different than legal for DNS). This label passes the first two tests, and only fails the third. –  Andrew B Mar 23 at 20:53
    
@AndrewB thanks for the edits. –  Ben Wilber Mar 23 at 21:08
2  
This doesn't answer the OP's question. I too saw what they report and whilst it may not be legal it was returning an address. The address was (for me) the same as the A record. –  Iain Mar 23 at 22:55

I did see the behaviour you describe but it looks like whatever was causing this to happen has been 'fixed' as

 dig  http://www.ecanvasser.com

now (correctly) returns NXDOMAIN.

FWIW I had the same IP address returned for both (I'm in the UK and was directed to ie...).


My initial thoughts (which are moot now) were that it was being handled as a wildcard entry but the : and / aren't valid characters for hostnames so whatever it was, was going an extra mile to be helpful.

share|improve this answer

Are you sure you are getting a responce

I may be mistaken but dig command is used in this way, without http:// or www.

#dig google.com

; <<>> DiG 9.9.5-2-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63957
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 4, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     254 IN  A   173.194.113.65
google.com.     254 IN  A   173.194.113.66
google.com.     254 IN  A   173.194.113.67
google.com.     254 IN  A   173.194.113.68
google.com.     254 IN  A   173.194.113.69
google.com.     254 IN  A   173.194.113.70
google.com.     254 IN  A   173.194.113.71
google.com.     254 IN  A   173.194.113.72
google.com.     254 IN  A   173.194.113.73
google.com.     254 IN  A   173.194.113.78
google.com.     254 IN  A   173.194.113.64

;; AUTHORITY SECTION:
google.com.     53642   IN  NS  ns3.google.com.
google.com.     53642   IN  NS  ns1.google.com.
google.com.     53642   IN  NS  ns4.google.com.
google.com.     53642   IN  NS  ns2.google.com.

;; ADDITIONAL SECTION:
ns1.google.com.     226442  IN  A   216.239.32.10
ns2.google.com.     226442  IN  A   216.239.34.10
ns3.google.com.     226666  IN  A   216.239.36.10
ns4.google.com.     226666  IN  A   216.239.38.10

;; Query time: 14 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Sun Mar 23 18:55:55 EET 2014
;; MSG SIZE  rcvd: 351
share|improve this answer
1  
http// for sure but www.example.com and example.com could easily be different machines. –  Iain Mar 23 at 17:14
    
yea thats true one is website and the other could be DNS or a mail server, or maybe i'm wrong :) –  Tasos Mar 23 at 17:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.