3

We have a Windows 2012 AD environment with two domain controllers. We have a mac workstation which has an IP of 10.8.214.30. It resolves fine and pings fine, but when you do an nslookup you get the following:

C:\Windows\system32>nslookup MAC5 DC1
Server:  DC1.ny.ald.com
Address:  10.10.0.1

Name:    MAC5.ny.ald.com
Addresses:  10.8.215.45
          10.8.214.30

Note that it returns two IP's. I am unable to determine where there is an entry for 10.8.215.45. I even created an entry for a non-existent host called DUMMY and assigned that IP to it -

C:\Windows\system32>nslookup dummy DC1
Server:  DC1.ny.ald.com
Address:  10.10.0.1

Name:    dummy.ny.ald.com
Address:  10.8.215.45

Likewise -

C:\Windows\system32>nslookup 10.8.215.45 DC1
Server:  DC1.ny.ald.com
Address:  10.10.0.1

Name:    dummy.ny.ald.com
Address:  10.8.215.45

As you can see it resolves properly. Why does the MAC5 host still include this IP? Is there any way to do a search of DNS in DNS Manager to determine whether an incorrect entry exists in one of the many sub-folders?

--------------------------------------------------------per THECLEANER suggestion --------
Using the debug option, I get -
I got the following using the debug option -
Got answer:
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0, additional = 0

QUESTIONS:
1.0.10.10.in-addr.arpa, type = PTR, class = IN
ANSWERS:
-> 1.0.10.10.in-addr.arpa
name = DC1.ny.ald.com
ttl = 1200 (20 mins)

------------
Server: DC1.ny.ald.com
Address: 10.10.0.1

------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 2, authority records = 0, additional = 0

QUESTIONS:
MAC5.ny.ald.com, type = A, class = IN
ANSWERS:
-> MAC5.ny.ald.com
internet address = 10.8.214.30
ttl = 1200 (20 mins)
-> MAC5.ny.ald.com
internet address = 10.8.215.45
ttl = 1200 (20 mins)

------------
------------
Got answer:
HEADER:
opcode = QUERY, id = 3, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
MAC5.ny.ald.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> ny.ald.com
ttl = 3600 (1 hour)
primary name server = DC1.ny.ald.com
responsible mail addr = admin.ny.ald.com
serial = 765192
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)

------------
Name: MAC5.ny.ald.com
Addresses: 10.8.214.30
10.8.215.45

Improve this question
3
  • nslookup has a set debug and a set d2 option if you type nslookup and then hit enter first. This will give you the full DNS lookup query information.
    – TheCleaner
    Nov 25, 2014 at 17:13
  • Sorry if its a stupid question, but does your MAC also have a wireless nic? Regarding your DNS server, I was gonna say you could export your tables to text, but it looks like TheCleaner has a better answer.
    – user255558
    Nov 25, 2014 at 17:25
  • Thx. I edited the original post to add the results of debug. Still doesn't shed any additional light though...
    – Anthony Aldridge
    Nov 25, 2014 at 18:17

1 Answer 1

Reset to default
2

No "searching" is necessary. There are two A records for MAC5.ny.ald.com in the ny.ald.com forward lookup zone. The DNS server is returning both of them to nslookup.

Jump into DNS Management, navigate to that forward lookup zone, and delete the "A" record that you don't want to be in there. (Likely the device has a wired and wireless NIC and has had both IP addresses registered in DNS.)

Improve this answer
1
  • I should have mentioned that I've already done that portion of troubleshooting. There is no additional record referencing that IP nor that hostname in the forward lookup. Ditto for reverse.
    – Anthony Aldridge
    Nov 25, 2014 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .