I'm trying to understand how DNS works. I use nslookup for that purpose. But there are some doubts i have.

  1. I'm getting different results using different ns servers. For example when i ask for "abc.com" using "dns.server1.pl" i'm getting "" but when i use "dns.server2.de" i'm getting ""
  2. I'm getting "Query refused" when i explicitly specify a dns server using "server" option
  3. What is the difference between "server" and "lserver" option? Some example please.

closed as off-topic by Jenny D, Khaled, MadHatter, EEAA, masegaloeh Jun 20 '15 at 13:17

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – MadHatter, EEAA, masegaloeh
  • "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – Jenny D, Khaled
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Don't use nslookup - use dig. 1) See serverfault.com/q/152003/120438 2 & 3 Read the RFCs and the BIND documentation. – Jenny D Jun 20 '15 at 7:19
  • Why was my question voted down!? What's wrong with it? – Mulligan1981 Jun 21 '15 at 8:35
  • If you hover over the downvote button, it'll tell you the standard reason for downvotes. If the downvoter did not leave a comment, you may assume this to be the reason. – Jenny D Jun 21 '15 at 8:38

Different IP for the same host are used to split network traffic eg. from different traffic and direct it to local servers.

There are several server mirroring methods. Some of them use explicit redirects from main host do mirror hosts, and some other (eg. mirror.centos.org) implicitly use different IPs for the same host.

You query polish and german servers, so probably this is exactly it.

ad. 2. DNS server can be configured to respond only for queries from allowed networks (eg. only from LAN, or only from specified country), and refuse all other queries.

ad. 3. Let me quote the Debian manual for nslookup:

[lserver] Change the default server to domain; lserver uses the initial server to look up information about domain, while server uses the current default server. If an authoritative answer can't be found, the names of servers that might have the answer are returned.

  • Re (2), this is fairly normal behaviour for DNS admins, these days, as it helps stop one's DNS server being used for amplification attacks. – MadHatter Jun 20 '15 at 7:46
  • This was fairly normal also 10 or 15 years ago, to stop people from abusing other people's resources. The only "new" thing is geo-targeting. – Tomasz Klim Jun 20 '15 at 9:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.