DNS lokup adding dmain name



  • Why when i do an nslookup on google.com is it returning with google.com.mydomain.com?

    Let me know what other info you need.

    Thanks,
    Peter


  • Rebel Alliance Global Moderator

    that is a client setting to append search domains.

    could you post the output of your nslookup

    You normally would not see that unless you set debug, if you don't want it to happen you can end your host entry with .

    So for example here is query for google.com, notice return the answer – but if I set debug, see how it asked for both the A and AAAA records with my local.lan domain attached.

    
    C:\>nslookup
    Default Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    > google.com
    Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    Non-authoritative answer:
    Name:    google.com
    Addresses:  74.125.225.82
              74.125.225.81
              74.125.225.84
              74.125.225.80
              74.125.225.83
    
    > set debug
    > google.com
    Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 6, rcode = NXDOMAIN
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 0,  authority records = 1,  additional = 0
    
        QUESTIONS:
            google.com.local.lan, type = A, class = IN
        AUTHORITY RECORDS:
        ->  (root)
            ttl = 86261 (23 hours 57 mins 41 secs)
            primary name server = a.root-servers.net
            responsible mail addr = nstld.verisign-grs.com
            serial  = 2011110701
            refresh = 1800 (30 mins)
            retry   = 900 (15 mins)
            expire  = 604800 (7 days)
            default TTL = 86400 (1 day)
    
    ------------
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 7, rcode = NXDOMAIN
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 0,  authority records = 1,  additional = 0
    
        QUESTIONS:
            google.com.local.lan, type = AAAA, class = IN
        AUTHORITY RECORDS:
        ->  (root)
            ttl = 86261 (23 hours 57 mins 41 secs)
            primary name server = a.root-servers.net
            responsible mail addr = nstld.verisign-grs.com
            serial  = 2011110701
            refresh = 1800 (30 mins)
            retry   = 900 (15 mins)
            expire  = 604800 (7 days)
            default TTL = 86400 (1 day)
    
    ------------
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 8, rcode = NOERROR
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 5,  authority records = 0,  additional = 0
    
        QUESTIONS:
            google.com, type = A, class = IN
        ANSWERS:
        ->  google.com
            internet address = 74.125.225.82
            ttl = 161 (2 mins 41 secs)
        ->  google.com
            internet address = 74.125.225.81
            ttl = 161 (2 mins 41 secs)
        ->  google.com
            internet address = 74.125.225.84
            ttl = 161 (2 mins 41 secs)
        ->  google.com
            internet address = 74.125.225.80
            ttl = 161 (2 mins 41 secs)
        ->  google.com
            internet address = 74.125.225.83
            ttl = 161 (2 mins 41 secs)
    
    ------------
    Non-authoritative answer:
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 9, rcode = NOERROR
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 0,  authority records = 1,  additional = 0
    
        QUESTIONS:
            google.com, type = AAAA, class = IN
        AUTHORITY RECORDS:
        ->  google.com
            ttl = 474 (7 mins 54 secs)
            primary name server = ns1.google.com
            responsible mail addr = dns-admin.google.com
            serial  = 1467440
            refresh = 7200 (2 hours)
            retry   = 1800 (30 mins)
            expire  = 1209600 (14 days)
            default TTL = 300 (5 mins)
    
    ------------
    Name:    google.com
    Addresses:  74.125.225.82
              74.125.225.81
              74.125.225.84
              74.125.225.80
              74.125.225.83
    
    >
    
    

    If use . on the end like google.com. then it doesn't do that

    
    C:\>nslookup
    Default Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    > google.com.
    Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    Non-authoritative answer:
    Name:    google.com
    Addresses:  74.125.225.83
              74.125.225.84
              74.125.225.81
              74.125.225.82
              74.125.225.80
    
    > set debug
    > google.com.
    Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 4, rcode = NOERROR
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 5,  authority records = 0,  additional = 0
    
        QUESTIONS:
            google.com, type = A, class = IN
        ANSWERS:
        ->  google.com
            internet address = 74.125.225.83
            ttl = 291 (4 mins 51 secs)
        ->  google.com
            internet address = 74.125.225.84
            ttl = 291 (4 mins 51 secs)
        ->  google.com
            internet address = 74.125.225.81
            ttl = 291 (4 mins 51 secs)
        ->  google.com
            internet address = 74.125.225.82
            ttl = 291 (4 mins 51 secs)
        ->  google.com
            internet address = 74.125.225.80
            ttl = 291 (4 mins 51 secs)
    
    ------------
    Non-authoritative answer:
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 5, rcode = NOERROR
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 0,  authority records = 1,  additional = 0
    
        QUESTIONS:
            google.com, type = AAAA, class = IN
        AUTHORITY RECORDS:
        ->  google.com
            ttl = 428 (7 mins 8 secs)
            primary name server = ns1.google.com
            responsible mail addr = dns-admin.google.com
            serial  = 1467441
            refresh = 7200 (2 hours)
            retry   = 1800 (30 mins)
            expire  = 1209600 (14 days)
            default TTL = 300 (5 mins)
    
    ------------
    Name:    google.com
    Addresses:  74.125.225.83
              74.125.225.84
              74.125.225.81
              74.125.225.82
              74.125.225.80
    
    >
    
    

    Now you could turn off the use of search suffixes, but then would not allow you to do a dns query via just host name, like so

    
    C:\>nslookup
    Default Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    > p4-28g
    Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    Name:    p4-28g.local.lan
    Address:  192.168.1.4
    
    > set debug
    > p4-28g
    Server:  pfsense.local.lan
    Address:  192.168.1.253
    
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 4, rcode = NOERROR
            header flags:  response, auth. answer, want recursion, recursion avail.
            questions = 1,  answers = 1,  authority records = 0,  additional = 0
    
        QUESTIONS:
            p4-28g.local.lan, type = A, class = IN
        ANSWERS:
        ->  p4-28g.local.lan
            internet address = 192.168.1.4
            ttl = 3600 (1 hour)
    
    ------------
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 5, rcode = NOERROR
            header flags:  response, auth. answer, want recursion, recursion avail.
            questions = 1,  answers = 0,  authority records = 0,  additional = 0
    
        QUESTIONS:
            p4-28g.local.lan, type = AAAA, class = IN
    
    ------------
    Name:    p4-28g.local.lan
    Address:  192.168.1.4
    
    

    See how it auto added my local.lan to the search

    Now there is a group policy or reg key you can set to turn this control this functionality atleast for users of the dnsclient, like ping and browser, etc.  But nslookup is not effected – if you do not want nslookup to use your suffix and or search suffixes, etc. then just end the query with . like in my above example.

    Here is info on that reg key entry
    http://blogs.technet.com/b/networking/archive/2009/04/16/dns-client-name-resolution-behavior-in-windows-vista-vs-windows-xp.aspx
    DNS Client Name Resolution behavior in Windows Vista vs. Windows XP

    HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\AppendToMultiLabelName

    Hope that helps!


  • Rebel Alliance Developer Netgate

    That happens most often when your domain has wildcard DNS active.

    The way DNS works, as laid out above, your search domain is appended before it queries farther up. Because you have wildcard DNS on, that returns a valid response.

    Without wildcard DNS, the entry does not exist, and it moves on to trying a higher level.


Locked