Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using the Linux tool dig to see the DNS records for my website. When I type in


it returns one IP address and when I get one IP and when I type in


it gives me a different IP.

Why would http:// make a different to the DNS record being returned?

I should mention I'm using AWS Route53 so that US IP addresses go to a US server and other IP addresses go to the main server.


share|improve this question
Please show us the output of the second dig command. – Iain Mar 23 '14 at 16:58
Don't prefix http:// that's the protocol not your domain and those characters are invalid in DNS. – Jacob Mar 23 '14 at 20:47

4 Answers 4

This could be possible if you setup a wildcard DNS record like:

* IN A 

And configured a different record for

Needless to say, you shouldn't add http:// to the DNS query since this is not part of the hostname.
No normal client would do that.

share|improve this answer
Most likely. http://www is the label being looked up within the domain, as opposed to www. – Andrew B Mar 23 '14 at 18:50

Hostnames with a http:// prefix are illegal, as are all hostnames with a protocol prefix. Most resolvers would return NXDOMAIN in this case, however, many ISPs and others return their own IPs in place of NXDOMAIN responses such as OpenDNS:

$ host
Using domain server:
Aliases: has address
Host not found: 3(NXDOMAIN)

See how it says " has address" -- that's a lie. That IP goes to OpenDNS' landing page where they show you ads.

share|improve this answer
You might want to read RFC1912 2.1...there is a vast difference between what characters are legal in a label, what legalities are required to be enforced by implementations, and what characters are illegal for a hostname (which is different than legal for DNS). This label passes the first two tests, and only fails the third. – Andrew B Mar 23 '14 at 20:53
@AndrewB thanks for the edits. – Ben Wilber Mar 23 '14 at 21:08
This doesn't answer the OP's question. I too saw what they report and whilst it may not be legal it was returning an address. The address was (for me) the same as the A record. – Iain Mar 23 '14 at 22:55

I did see the behaviour you describe but it looks like whatever was causing this to happen has been 'fixed' as


now (correctly) returns NXDOMAIN.

FWIW I had the same IP address returned for both (I'm in the UK and was directed to ie...).

My initial thoughts (which are moot now) were that it was being handled as a wildcard entry but the : and / aren't valid characters for hostnames so whatever it was, was going an extra mile to be helpful.

share|improve this answer

Are you sure you are getting a responce

I may be mistaken but dig command is used in this way, without http:// or www.


; <<>> DiG 9.9.5-2-Ubuntu <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63957
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 4, ADDITIONAL: 5

; EDNS: version: 0, flags:; udp: 4096
;            IN  A

;; ANSWER SECTION:     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A     254 IN  A

;; AUTHORITY SECTION:     53642   IN  NS     53642   IN  NS     53642   IN  NS     53642   IN  NS

;; ADDITIONAL SECTION:     226442  IN  A     226442  IN  A     226666  IN  A     226666  IN  A

;; Query time: 14 msec
;; WHEN: Sun Mar 23 18:55:55 EET 2014
;; MSG SIZE  rcvd: 351
share|improve this answer
http// for sure but and could easily be different machines. – Iain Mar 23 '14 at 17:14
yea thats true one is website and the other could be DNS or a mail server, or maybe i'm wrong :) – Tasos Mar 23 '14 at 17:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.