Command dig / nslookup shows unexpected results

accidentallyadmin

Greetings good people,

I have a peculiar problem, I'm not even sure if it's related to pfsense, so here it goes.

As per usual, I'm using pfsense as my gateway to internet. In it, I use it's multiple capabilities, including multi-WAN connections, multi VLANs, pretty extensive firewall, unbound DNS resolver, openVPN, haproxy, et cetera. And so far it's been working nicely.

I have a client (outside network) that I maintain. They have several public services including web, mail and DNS servers, all working well. Their DNS server (ns1.example.com) is kind of old and in need of replacement, so I build them a new one (ns2.example.com). I also made some record changes in it, one of which is for their web server address. The old record is 1.2.3.4 (still serving from ns1.example.com) and the new one will be 5.6.7.8 (from ns2.example.com). All is well until the time for testing.

If I launch nslookup (yes, I'm using Windows, get over it) as it is, this is the result:

nslookup www.example.com
Server:  my.local.pfsense
Address:  192.168.1.1

Non-authoritative answer:
Name:    www.example.com
Address:  1.2.3.4

That result is normal as expected. If I launch nslookup and tell it to use the old DNS server or even any public DNS server, this is the result:

nslookup www.example.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    www.example.com
Address:  1.2.3.4

That result is also normal as expected. Now, if I launch nslookup and tell it to use ns2.example.com from behind my pfsense (this is important), this is the result:

nslookup www.example.com ns2.example.com
Server:  ns2.example.com
Address:  xx.xx.xx.xx

Non-authoritative answer:
Name:    www.example.com
Address:  1.2.3.4

That is unexpected! Remember that I changed the record of web server to 5.6.7.8 in the new DNS server (ns2.example.com). But if launch the command not behind my pfsense (either via hotspot tether, or using any computer outside the network), then the result is correct:

nslookup www.example.com ns2.example.com
Server:  ns2.example.com
Address:  xx.xx.xx.xx

Non-authoritative answer:
Name:    www.example.com
Address:  5.6.7.8

Even after waiting 24hr thinking that it might have something to do with propagation time, the result is still the same. Whenever i test it behind my pfsense, it always point to 1.2.3.4. But if I test it from outside network, then the result is 5.6.7.8

So, anybody had similar experience? How did you solve it? Or any insight is most welcome. Thank you.

patient0

@accidentallyadmin have you configured anything related (an override) to ns2.example.com in unbound on your pfSense?

Have you the possibility to use a second client behind your pfSense to verify that it's not client/client caching issue. It shouldn't be a caching issue since you're querying the name server directly but who knows.

Gertjan

@accidentallyadmin

Humm, yes, I get your point.
Try interactive mode ?
Like

nslookup
set debug
server ns2.example.com

When I did this, It shows me that it was asking my ns1 for the IP of ns2.

What happens when you use the IP of ns2 instead of it's host name ?

You've 'admin' access to ns1 and ns2 ? Check the logs of both 'DNS' servers.

Btw : normally, I manage a ns1, it's the master.
My ns2 ns3 etc are salves, so any changes to the master are synced with the slaves.
Are both your DNS servers 'masters' of the zone ?

tinfoilmatt

To clear Unbound's cache:
unbound-control -c /var/unbound/unbound.conf reload

To clear a single domain:
unbound-control -c /var/unbound/unbound.conf flush [www.example.com]

To 'dump' the cache for inspection:
unbound-control -c /var/unbound/unbound.conf dump_cache