113

Basically, it's what the name says it is. An authoritative answer comes from a nameserver that is considered authoritative for the domain which it's returning a record for (one of the nameservers in the list for the domain you did a lookup on), and a non-authoritative answer comes from anywhere else (a nameserver not in the list for the domain you did a ...


113

Think of it like this: DNS is the phone directory/yellow pages. When someone wants to call your phone, they can look up your name and get your phone number and call that phone. DNS does the same but for computers - when someone wants to go to www.example.com they ask DNS for the IP address and then they can contact the computer that has that IP address. ...


104

CNAME records were originally created to allow multiple names that provide the same resource to be aliased to a single "canonical name" for the resource. With the advent of name based virtual hosting, it has instead become commonplace to use them as a generic form of IP address aliasing. Unfortunately, most people who come from a web hosting background ...


103

DNSSEC has some risks, but they are not directly related to reflection or amplification. The EDNS0 message size expansion is a red herring in this case. Let me explain. Any exchange of packets that does not depend on a previous proof of identity is subject to abuse by DDoS attackers who can use that unauthenticated packet exchange as a reflector, and ...


92

The whole idea behind the MX record is to specify a host or hosts which can accept mail for a domain. As specified in RFC 1035, the MX record contains a domain name. It must therefore point to a host which itself can be resolved in the DNS. An IP address could not be used as it would be interpreted as an unqualified domain name, which cannot be resolved. ...


85

A much easier command to remember (and more informative) is: > dig google.com ANY Which returns the following: ; <<>> DiG 9.8.3-P1 <<>> google.com ANY ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31013 ;; flags: qr rd ra; QUERY: 1, ANSWER: 22, AUTHORITY: 0, ADDITIONAL: 3 ...


83

You can work around this issue in one of two ways, both of which are in the VirtualBox manual: Enabling DNS proxy in NAT mode The NAT engine by default offers the same DNS servers to the guest that are configured on the host. In some scenarios, it can be desirable to hide the DNS server IPs from the guest, for example when this information can ...


81

Disclaimer: No offense, but this is a really bad idea. I do not recommend that anyone do this in real life. But if you give a bored IT guy a lab, funny things will happen! For this experiment, I used a Microsoft DNS server running on Server 2012 R2. Because of the complications of hosting a DNS zone in Active Directory, I created a new primary zone named ...


79

Sigh. I've had a few clients fall trap to this by using afraid.org as their DNS provider. Because they're free, they allow anyone who wants to to create subdomains off your primary domain, unless you specifically disallow it. You can see here: https://freedns.afraid.org/domain/registry/?sort=5&q=gotgenes&submit=SEARCH that someone has created 79 ...


74

Following up on https://serverfault.com/a/453260/14832, if you're using a version 2 Vagrantfile config format, the one which starts: Vagrant.configure("2") do |config| Then you might want to add this to that config file: config.vm.provider :virtualbox do |vb| vb.customize ["modifyvm", :id, "--natdnshostresolver1", "on"] end If you're using the old ...


71

Woo, I found a post on github that solved my problem. After Steve K. pointed out that it wasn't actually a DNS issue and was a connectivity issue, I was able to find a post on github that described how to fix this problem. Apparently the docker0 network bridge was hung up. Installing bridge-utils and running the following got my Docker in working order: ...


67

The TTL for negative caching is not arbitrary. It is taken from the SOA record at the top of the zone to which the requested record would have belonged, had it existed. For example: example.org. IN SOA master-ns1.example.org. Hostmaster.example.org. ( 2012091201 43200 1800 1209600 86400 ) The last value in the SOA record ("86400") ...


65

I requested that this answer be merged in from a duplicate question, as the existing answers did not explain the role of the ADDITIONAL section. To see how it works, type this: dig +trace +additional google.com SOA This will trace the nameserver authority starting from the root servers (+trace). Adding +additional will also show you the ADDITIONAL section ...


63

try adding: # put actual dns name here dhcp-option DNS 10.11.12.13 to your client's config


63

According to the Section 5 of RFC 5321, if no MX record is present mail servers should fall back to the A record for the domain. This is probably what's happening.


63

There is no record for that subdomain: $ dig BDASERVER.businessdts.com ; <<>> DiG 9.8.3-P1 <<>> BDASERVER.businessdts.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 11871 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;BDASERVER....


62

Multiple CNAME records for the same fully-qualified domain name is a violation of the specs for DNS. Some versions of BIND would allow you to do this (some only if you specified the multiple-cnames yes option) and would round-robin load-balance between then but it's not technically legal. There are not supposed to be resource records (RRs) with the same ...


60

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @JourneymanGeek), and some jovial hacking around we got to the bottom of both your question and the situation on the whole. Sorry for brusqueness and misunderstanding ...


58

What they're talking about is that when you use a CNAME to point to their services (which is only possible on subdomain, not the zone root - it can't coexist with the SOA and NS records that are required on the root of your zone), they can make a change to their own DNS records to work around some kind of availability issue. With a zone root, you must use ...


58

Anyone who has a cached copy of the domain record will not bother updating it for 24 hours, so yes if your intent is to have at most a 5 minute window of unavailability you should wait until all of the outstanding caches have updated to live no more than 5 minutes.


54

The host program uses libresolv to perform a DNS query directly, i.e., does not use gethostbyname. Most programs, when attempting to connect to another host, invoke the gethostbyname system call or a similar function. This function obeys the configuration of /etc/nsswitch.conf. This file has a line which in Ubuntu 12.04 defaults to the following: hosts: ...


54

Using an IP address ensures that you are not relying on a DNS server. It also has the benefit of preventing attacks through DNS spoofing. Using a FQDN instead of an IP address means that, if you were to migrate your service to a server with a different IP address, you would be able to simply change the record in DNS rather than try and find everywhere that ...


54

The way described is the way you create multiple records on Route 53. Entering two values in the textarea separated by a newline will result in two distinct records in the DNS. This is why Amazon call it a "record set" - it is a set of records.


51

If you happen to be stuck on a windows box and only have access to nslookup: nslookup -qa=A -debug host.example.com authoritiative-dns-host-here.com


51

They're 13 highly available clusters of servers, not simply 13 servers. Among other things, root nameserver operators are required to have enough capacity to handle three times their normal traffic load (RFC 2870). This leads to rather large clusters. However, the root nameservers only serve responses for the top level domains themselves, i.e. com., net., ...


51

I take it this is a question specifically about the name of the RR type? It obviously could have had a different name, the name AAAA for IPv6 address records is in reference to an IPv6 address (128 bits) being four times the size of an IPv4 address (32 bits).


51

The most likely explanation is a user unfamiliar with DNS tried to configure the DNS records and made a mistake that's glaringly obvious to anyone familiar with DNS, but not to people who aren't. While a DNS label can be any arbitary binary data generally, you should read the rest of section 11, in particular: Note however, that the various applications ...


49

Look at the answer section a little more closely: ;; ANSWER SECTION: 444.333.222.111.in-addr.arpa. 86365 IN PTR main.funkeedomain.org.333.222.111.in-addr.arpa. Specifically, the value of the PTR record: main.funkeedomain.org.333.222.111.in-addr.arpa. Your ISP forgot to add the trailing dot to your FQDN. This is causing the DNS software to helpfully ...


47

Once DKIM was setup (for help, see this guide) and verified successfully on my domain I still had to enable it in the AWS console at SES -> Domains -> DKIM Once that was done mails to Gmail no longer show up with the via bounces address. You can see it still shows as mailed by: amazonses.com when you view details of the sender but that's OK since ...


47

The client does not know in advance that the response will be too large, so it will query the server via UDP. The server will respond via UDP and will include as much as possible and set the truncated header bit ("TC" http://www.networksorcery.com/enp/protocol/dns.htm). The client can then resend the request via TCP and get the full response. See also: ...


Only top voted, non community-wiki answers of a minimum length are eligible