-2

I'm trying to understand how DNS works. I use nslookup for that purpose. But there are some doubts i have.

  1. I'm getting different results using different ns servers. For example when i ask for "abc.com" using "dns.server1.pl" i'm getting "233.66.8.9" but when i use "dns.server2.de" i'm getting "121.26.28.50"
  2. I'm getting "Query refused" when i explicitly specify a dns server using "server" option
  3. What is the difference between "server" and "lserver" option? Some example please.
Improve this question
3
  • 1
    Don't use nslookup - use dig. 1) See serverfault.com/q/152003/120438 2 & 3 Read the RFCs and the BIND documentation.
    – Jenny D
    Jun 20, 2015 at 7:19
  • Why was my question voted down!? What's wrong with it?
    – Mulligan1981
    Jun 21, 2015 at 8:35
  • If you hover over the downvote button, it'll tell you the standard reason for downvotes. If the downvoter did not leave a comment, you may assume this to be the reason.
    – Jenny D
    Jun 21, 2015 at 8:38

1 Answer 1

Reset to default
1

Different IP for the same host are used to split network traffic eg. from different traffic and direct it to local servers.

There are several server mirroring methods. Some of them use explicit redirects from main host do mirror hosts, and some other (eg. mirror.centos.org) implicitly use different IPs for the same host.

You query polish and german servers, so probably this is exactly it.

ad. 2. DNS server can be configured to respond only for queries from allowed networks (eg. only from LAN, or only from specified country), and refuse all other queries.

ad. 3. Let me quote the Debian manual for nslookup:

[lserver] Change the default server to domain; lserver uses the initial server to look up information about domain, while server uses the current default server. If an authoritative answer can't be found, the names of servers that might have the answer are returned.

Improve this answer
2
  • Re (2), this is fairly normal behaviour for DNS admins, these days, as it helps stop one's DNS server being used for amplification attacks.
    – MadHatter
    Jun 20, 2015 at 7:46
  • This was fairly normal also 10 or 15 years ago, to stop people from abusing other people's resources. The only "new" thing is geo-targeting.
    – Tomasz Klim
    Jun 20, 2015 at 9:01

Not the answer you're looking for? Browse other questions tagged .