Tag Info

Hot answers tagged

84

This is not directly a DNS problem, it's a network routing problem between some parts of the internet and the DNS servers for serverfault.com. Since the nameservers can't be reached the domain stops resolving. As far as I can tell the routing problem is on the (Global Crossing?) router with IP address 204.245.39.50. As shown by @radius, packets to ns52 ...


77

Actually, it's more complicated than that - rather than one "central registry (that) holds a table that maps domains (www.mysite.com) to DNS servers", there are several layers of hierarchy There's a central registry (the Root Servers) which contain only a small set of entries: the NS (nameserver) records for all the top-level domains - .com, .net, .org, ...


72

ping -a w.x.y.z Should resolve the name from the IP address if the reverse lookup zone has been set up properly. If the reverse lookup zone does not have an entry for the record, the -a will just ping without a name.


71

Sigh. I've had a few clients fall trap to this by using afraid.org as their DNS provider. Because they're free, they allow anyone who wants to to create subdomains off your primary domain, unless you specifically disallow it. You can see here: https://freedns.afraid.org/domain/registry/?sort=5&q=gotgenes&submit=SEARCH that someone has created 79 ...


65

By 'DNS failover' I take it you mean DNS Round Robin combined with some monitoring, i.e. publishing multiple IP addresses for a DNS hostname, and removing a dead address when monitoring detects that a server is down. This can be workable for small, less trafficked websites. By design, when you answer a DNS request you also provide a Time To Live (TTL) for ...


61

Do not use an invented TLD. If ICANN were to delegate it, you would be in big trouble. Same thing if you merge with another organization which happens to use the same dummy TLD. That's why globally unique domain names are preferred. The standard, RFC 2606 reserves names for examples, documentation, testing, but nothing for general use, and for good reasons: ...


48

Yes, the number there is the number of seconds left until that record expires (providing we're not querying the authoritative nameserver). Obviously with a CNAME there's a level of redirection, so the TTL for the A record it points to in this case may be important as well. If you wait a couple of seconds and run dig again on your local nameserver, you ...


46

Is it really that easy for an attacker to forge an IP address in the wild? Sure, if I don't care about actually receiving any responses, I can very easily send out packets using any source address I like. Since many ISPs don't really have good egress rules, anything I forge generally will be delivered. If the attacker actually needs two way ...


44

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?). That said, you can use dig to list the other records by doing: dig +nocmd yourdomain.com any +multiline +noall +answer


43

"DNS propagation" isn't a real phenomenon, per se. Rather, it is the manifest effect of the caching functionality specified in the DNS protocol. Saying that changes "propagate" between DNS servers is a convenient falsehood that's, arguably, easier to explain to non-technical users than describing all of the details of the DNS protocol. It's not really how ...


43

Basically, someone has managed to convince the owners of the ccTLD 'to.' (Tonga?) to assign the A record to their own IP address. Quite a coup in the strange old world of URL shorteners. Normally these top-levels would not have IP addresses assigned via a standard A record, but there is nothing to say that the same could not be done to .uk, .com, .eu, etc. ...


43

They're 13 highly available clusters of servers, not simply 13 servers. Among other things, root nameserver operators are required to have enough capacity to handle three times their normal traffic load (RFC 2870). This leads to rather large clusters. However, the root nameservers only serve responses for the top level domains themselves, i.e. com., net., ...


42

No. DNS is not aware of HTTP or HTTPS. Compare it to asking for secretary the phone number (IP number) for someone. You will get the same reply, no matter what you wanted to ask the person on the other end.


42

As stated by many others, IP headers are trivial to forge, as long as one doesn't care about receiving a response. This is why it is mostly seen with UDP, as TCP requires a 3-way handshake. One notable exception is the SYN flood, which uses TCP and attempts to tie up resources on a receiving host; again, as the replies are discarded, the source address does ...


41

The public DNS name always matches the public IP address. The public IP address stays the same for an instance until it is terminated or stopped. A reboot does not change the public IP address. If a stopped instance is started again, it will probably receive a different public IP address. Instances can fail. When you start a new instance to replace a ...


39

I wouldn't run my own DNS server - in my case, the hosting company that hosts my website provides free DNS service. There are also alternatives, companies that do nothing but DNS hosting (DNS Made Easy comes to mind, but there are many others) which are the kind of thing you should probably look into. The reason I wouldn't do it myself is that DNS is ...


38

GoDaddy [...] I assume their servers are geographically distributed Don't assume, verify with GoDaddy or verify it yourself. A quick traceroute to nsX.secureserver.com (a common DNS server name for GoDaddy) gives me a response from a datacenter here in Scandinavia where I live. So yes, it seems that GoDaddy has its nameservers spread out over at least ...


38

I would choose a consistent approach across the entire environment. Both solutions work fine and will remain compatible with most applications. There is a difference in manageability, though. I go with the short name as the HOSTNAME setting, and set the FQDN as the first column in /etc/hosts for the server's IP, followed by the short name. I have not ...


35

According to the Section 5 of RFC 5321, if no MX record is present mail servers should fall back to the A record for the domain. This is probably what's happening.


35

A glue record is a term for a record that's served by a DNS server that's not authoritative for the zone, to avoid a condition of impossible dependencies for a DNS zone. Say I own a DNS zone for example.com. I want to have DNS servers that're hosting the authoritative zone for this domain so that I can actually use it - adding records for the root of the ...


34

What they're talking about is that when you use a CNAME to point to their services (which is only possible on subdomain, not the zone root - it can't coexist with the SOA and NS records that are required on the root of your zone), they can make a change to their own DNS records to work around some kind of availability issue. With a zone root, you must use ...


32

To facilitate failover schemes, a common technique is to use DNS CNAME records (DNS Aliases) for different machine roles. Then instead of changing the Windows computername of the actual machine name, one can switch a DNS record to point to a new host. This can work on Microsoft Windows machines, but to make it work with file sharing the following ...


32

Jeff, I disagree, load balancing does not imply redundancy, it's quite the opposite in fact. The more servers you have, the more likely you'll have a failure at a given instant. That's why redundancy IS mandatory when doing load balancing, but unfortunately there are a lot of solutions which only provide load balancing without performing any health check, ...


31

Assigning more than one IP address to one hostname is also possible: rr.example.com. A 192.0.2.12 rr.example.com. A 192.0.2.23 rr.example.com. A 192.0.2.34 rr.example.com. A 192.0.2.45 When you query a DNS server for rr.example.com you'll get back a list of IP addresses back. You can then choose to connect ...


30

There's probably no harm in having those other domains pointing to your host, except of course that it increases the load on your server. If you want to block them, set up new virtual hosts for them: NameVirtualHost *:80 <VirtualHost *:80> ServerName example.com # example.com configuration </VirtualHost> <VirtualHost *:80> ...


30

Yes, that's an appropriate use of CNAMEs. In the discussions I've been part of, the arguments tend to go like this: Against CNAMEs: There is a (tiny) performance penalty, as the downstream DNS caches need to perform 2 DNS lookups, one for the CNAME and one for the A-Record the CNAME points to. Vague, bogus arguments about CNAMEs having less "authority" or ...


29

If they can both see the name servers in question (i.e., not on an internal network to one of them)...sure.


29

nslookup <ip> Does what you're looking for. It will tell you the server you're querying and the result. For example: c:\>nslookup 192.168.101.39 Server: dns1.local Address: 192.168.101.24 Name: enigma.local Address: 192.168.101.39


29

The trouble with "ping" is that it's not strictly a name server lookup tool (like nslookup) - for instance if you ping a hostname, it can be resolved to an IP address by a number of methods: DNS lookup, host file lookup, WINS (god forbid) or NetBIOS broadcast. It can also return a potentially out-dated cached result. The order in which the methods are ...


28

When I use the term "DNS Round Robin" I generally mean in in the sense of the "cheap load balancing technique" as OP describes it. But that's not the only way DNS can be used for global high availability. Most of the time, it's just hard for people with different (technology) backgrounds to communicate well. The best load balancing technique (if money is ...



Only top voted, non community-wiki answers of a minimum length are eligible