Tag Info

Hot answers tagged

86

ping -a w.x.y.z Should resolve the name from the IP address if the reverse lookup zone has been set up properly. If the reverse lookup zone does not have an entry for the record, the -a will just ping without a name.


85

This is not directly a DNS problem, it's a network routing problem between some parts of the internet and the DNS servers for serverfault.com. Since the nameservers can't be reached the domain stops resolving. As far as I can tell the routing problem is on the (Global Crossing?) router with IP address 204.245.39.50. As shown by @radius, packets to ns52 ...


80

Actually, it's more complicated than that - rather than one "central registry (that) holds a table that maps domains (www.mysite.com) to DNS servers", there are several layers of hierarchy There's a central registry (the Root Servers) which contain only a small set of entries: the NS (nameserver) records for all the top-level domains - .com, .net, .org, ...


71

Sigh. I've had a few clients fall trap to this by using afraid.org as their DNS provider. Because they're free, they allow anyone who wants to to create subdomains off your primary domain, unless you specifically disallow it. You can see here: https://freedns.afraid.org/domain/registry/?sort=5&q=gotgenes&submit=SEARCH that someone has created 79 ...


70

By 'DNS failover' I take it you mean DNS Round Robin combined with some monitoring, i.e. publishing multiple IP addresses for a DNS hostname, and removing a dead address when monitoring detects that a server is down. This can be workable for small, less trafficked websites. By design, when you answer a DNS request you also provide a Time To Live (TTL) for ...


64

Do not use an invented TLD. If ICANN were to delegate it, you would be in big trouble. Same thing if you merge with another organization which happens to use the same dummy TLD. That's why globally unique domain names are preferred. The standard, RFC 2606 reserves names for examples, documentation, testing, but nothing for general use, and for good reasons: ...


61

Disclaimer: No offense, but this is a really bad idea. I do not recommend that anyone do this in real life. But if you give a bored IT guy a lab, funny things will happen! For this experiment, I used a Microsoft DNS server running on Server 2012 R2. Because of the complications of hosting a DNS zone in Active Directory, I created a new primary zone named ...


55

Yes, the number there is the number of seconds left until that record expires (providing we're not querying the authoritative nameserver). Obviously with a CNAME there's a level of redirection, so the TTL for the A record it points to in this case may be important as well. If you wait a couple of seconds and run dig again on your local nameserver, you ...


52

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?). That said, you can use dig to list the other records by doing: dig +nocmd yourdomain.com any +multiline +noall +answer


46

Is it really that easy for an attacker to forge an IP address in the wild? Sure, if I don't care about actually receiving any responses, I can very easily send out packets using any source address I like. Since many ISPs don't really have good egress rules, anything I forge generally will be delivered. If the attacker actually needs two way ...


45

"DNS propagation" isn't a real phenomenon, per se. Rather, it is the manifest effect of the caching functionality specified in the DNS protocol. Saying that changes "propagate" between DNS servers is a convenient falsehood that's, arguably, easier to explain to non-technical users than describing all of the details of the DNS protocol. It's not really how ...


44

As stated by many others, IP headers are trivial to forge, as long as one doesn't care about receiving a response. This is why it is mostly seen with UDP, as TCP requires a 3-way handshake. One notable exception is the SYN flood, which uses TCP and attempts to tie up resources on a receiving host; again, as the replies are discarded, the source address does ...


44

A glue record is a term for a record that's served by a DNS server that's not authoritative for the zone, to avoid a condition of impossible dependencies for a DNS zone. Say I own a DNS zone for example.com. I want to have DNS servers that're hosting the authoritative zone for this domain so that I can actually use it - adding records for the root of the ...


44

I would choose a consistent approach across the entire environment. Both solutions work fine and will remain compatible with most applications. There is a difference in manageability, though. I go with the short name as the HOSTNAME setting, and set the FQDN as the first column in /etc/hosts for the server's IP, followed by the short name. I have not ...


43

Basically, someone has managed to convince the owners of the ccTLD 'to.' (Tonga?) to assign the A record to their own IP address. Quite a coup in the strange old world of URL shorteners. Normally these top-levels would not have IP addresses assigned via a standard A record, but there is nothing to say that the same could not be done to .uk, .com, .eu, etc. ...


43

The public DNS name always matches the public IP address. The public IP address stays the same for an instance until it is terminated or stopped. A reboot does not change the public IP address. If a stopped instance is started again, it will probably receive a different public IP address. Instances can fail. When you start a new instance to replace a ...


43

They're 13 highly available clusters of servers, not simply 13 servers. Among other things, root nameserver operators are required to have enough capacity to handle three times their normal traffic load (RFC 2870). This leads to rather large clusters. However, the root nameservers only serve responses for the top level domains themselves, i.e. com., net., ...


42

I wouldn't run my own DNS server - in my case, the hosting company that hosts my website provides free DNS service. There are also alternatives, companies that do nothing but DNS hosting (DNS Made Easy comes to mind, but there are many others) which are the kind of thing you should probably look into. The reason I wouldn't do it myself is that DNS is ...


42

No. DNS is not aware of HTTP or HTTPS. Compare it to asking for secretary the phone number (IP number) for someone. You will get the same reply, no matter what you wanted to ask the person on the other end.


39

GoDaddy [...] I assume their servers are geographically distributed Don't assume, verify with GoDaddy or verify it yourself. A quick traceroute to nsX.secureserver.com (a common DNS server name for GoDaddy) gives me a response from a datacenter here in Scandinavia where I live. So yes, it seems that GoDaddy has its nameservers spread out over at least ...


38

nslookup <ip> Does what you're looking for. It will tell you the server you're querying and the result. For example: c:\>nslookup 192.168.101.39 Server: dns1.local Address: 192.168.101.24 Name: enigma.local Address: 192.168.101.39


38

Jeff, I disagree, load balancing does not imply redundancy, it's quite the opposite in fact. The more servers you have, the more likely you'll have a failure at a given instant. That's why redundancy IS mandatory when doing load balancing, but unfortunately there are a lot of solutions which only provide load balancing without performing any health check, ...


38

What they're talking about is that when you use a CNAME to point to their services (which is only possible on subdomain, not the zone root - it can't coexist with the SOA and NS records that are required on the root of your zone), they can make a change to their own DNS records to work around some kind of availability issue. With a zone root, you must use ...


36

To facilitate failover schemes, a common technique is to use DNS CNAME records (DNS Aliases) for different machine roles. Then instead of changing the Windows computername of the actual machine name, one can switch a DNS record to point to a new host. This can work on Microsoft Windows machines, but to make it work with file sharing the following ...


36

The trouble with "ping" is that it's not strictly a name server lookup tool (like nslookup) - for instance if you ping a hostname, it can be resolved to an IP address by a number of methods: DNS lookup, host file lookup, WINS (god forbid) or NetBIOS broadcast. It can also return a potentially out-dated cached result. The order in which the methods are ...


36

Yes, that's an appropriate use of CNAMEs. In the discussions I've been part of, the arguments tend to go like this: Against CNAMEs: There is a (tiny) performance penalty, as the downstream DNS caches need to perform 2 DNS lookups, one for the CNAME and one for the A-Record the CNAME points to. Vague, bogus arguments about CNAMEs having less "authority" or ...


36

According to the Section 5 of RFC 5321, if no MX record is present mail servers should fall back to the A record for the domain. This is probably what's happening.


34

v=spf1 include:_spf.google.com include:otherdomain.com ~all There's no restriction against including multiple names in a single entry; Hotmail, for instance, takes this to extremes. Note that multiple includes, or nested ones, need to stay under the limit of 10 total DNS lookups for the whole SPF check.


33

Assigning more than one IP address to one hostname is also possible: rr.example.com. A 192.0.2.12 rr.example.com. A 192.0.2.23 rr.example.com. A 192.0.2.34 rr.example.com. A 192.0.2.45 When you query a DNS server for rr.example.com you'll get back a list of IP addresses back. You can then choose to connect ...


32

Try: dig -tAXFR mycompany.com This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works



Only top voted, non community-wiki answers of a minimum length are eligible