2

Why do I see ns / PTR records when running Resolve-DNSName with default options, -type A, and -DNSOnly?

What's the best syntax to use if I am planning to use the ip in a ip filter using pktmon?

Resolve-DnsName -name google.com 
Resolve-DnsName -name google.com -Type A
Resolve-DnsName -name google.com -DnsOnly

all return the following

Name                                           Type   TTL   Section    IPAddress                                
----                                           ----   ---   -------    ---------                                
google.com                                     AAAA   69    Answer     2607:f8b0:400a:806::200e                 
google.com                                     A      164   Answer     142.251.33.78                            

Name      : google.com
QueryType : NS
TTL       : 142298
Section   : Authority
NameHost  : ns1.google.com


Name      : google.com
QueryType : NS
TTL       : 142298
Section   : Authority
NameHost  : ns2.google.com

...
ns1.google.com                                 A      56547 Additional 216.239.32.10                            
ns1.google.com                                 AAAA   56547 Additional 2001:4860:4802:32::a                     
ns2.google.com                                 A      56547 Additional 216.239.34.10                            
ns2.google.com                                 AAAA   56547 Additional 2001:4860:4802:34::a                     
ns3.google.com                                 A      56547 Additional 216.239.36.10                            
ns3.google.com                                 AAAA   56547 Additional 2001:4860:4802:36::a                     
ns4.google.com                                 A      56547 Additional 216.239.38.10                            
ns4.google.com                                 AAAA   56547 Additional 2001:4860:4802:38::a   

For our corporate domain, I see NS records for root servers included

Name      : .
QueryType : NS
TTL       : 9512
Section   : Authority
NameHost  : h.root-servers.net


Name      : .
QueryType : NS
TTL       : 9512
Section   : Authority
NameHost  : d.root-servers.net


Name      : .
QueryType : NS
TTL       : 9512
Section   : Authority
NameHost  : c.root-servers.net

...
1
  • I can't replicate your situation. I am not getting any PTR or NS records when I perform simple DNS lookups with Resolve-DnsName running in Powershell. Are you trying to get just an IP address and remove all other text from the output?
    – madacoda
    Mar 3, 2022 at 4:33

3 Answers 3

2

Resolve-DnsName returns different object types for different portions of the DNS response. Notice how the "Section" property differs between the different sets of results: Answer vs Authority vs Additional. Those are all different parts of a DNS response that you may or may not get depending on who you're asking and what you're asking for. You can also see the object types more clearly by piping the result to Get-Member.

What you're probably looking for is only results in the Answer section. So you'd add a Where-Object clause like this:

Resolve-DnsName google.com | ?{ $_.Section -eq 'Answer' }

If you're querying a CNAME record, you'll end up with both the CNAME answer (and any nested CNAMEs) along with the A/AAAA records. So you might need additional filtering if all you care about are IPv4 A records.

Resolve-DnsName google.com | ?{ $_.Section -eq 'Answer' -and $_.Type -eq 'A' }
1

I get the same result as you do. Maybe it's a difference between Microsoft DNS and bind? This is what I use:

(Resolve-DnsName -name google.com | where-object {$_.section -eq 'Answer'}).ipaddress 

To avoid the IPv6 response:

(Resolve-DnsName -name google.com | where-object {$_.section -eq 'Answer' -and $_.type -eq 'A'}).ipaddress 
0

No matter which options you use, you'll be able to filter out IP like this :

Resolve-DnsName -name google.com | select ipAddress

I wasn't able to replicate the situation with NS Records too... If you got different type of records i think this is a dns recording matter, not a powershell issue. (i tried to replicate the same results as yours by doing

 Resolve-DnsName -name mydomain.net | select *

Got a SOA query but nothing else.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .