DNS lokup adding dmain name
-
Why when i do an nslookup on google.com is it returning with google.com.mydomain.com?
Let me know what other info you need.
Thanks,
Peter
-
that is a client setting to append search domains.
could you post the output of your nslookup
You normally would not see that unless you set debug, if you don't want it to happen you can end your host entry with .
So for example here is query for google.com, notice return the answer – but if I set debug, see how it asked for both the A and AAAA records with my local.lan domain attached.
C:\>nslookup Default Server: pfsense.local.lan Address: 192.168.1.253 > google.com Server: pfsense.local.lan Address: 192.168.1.253 Non-authoritative answer: Name: google.com Addresses: 74.125.225.82 74.125.225.81 74.125.225.84 74.125.225.80 74.125.225.83 > set debug > google.com Server: pfsense.local.lan Address: 192.168.1.253 ------------ Got answer: HEADER: opcode = QUERY, id = 6, rcode = NXDOMAIN header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: google.com.local.lan, type = A, class = IN AUTHORITY RECORDS: -> (root) ttl = 86261 (23 hours 57 mins 41 secs) primary name server = a.root-servers.net responsible mail addr = nstld.verisign-grs.com serial = 2011110701 refresh = 1800 (30 mins) retry = 900 (15 mins) expire = 604800 (7 days) default TTL = 86400 (1 day) ------------ ------------ Got answer: HEADER: opcode = QUERY, id = 7, rcode = NXDOMAIN header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: google.com.local.lan, type = AAAA, class = IN AUTHORITY RECORDS: -> (root) ttl = 86261 (23 hours 57 mins 41 secs) primary name server = a.root-servers.net responsible mail addr = nstld.verisign-grs.com serial = 2011110701 refresh = 1800 (30 mins) retry = 900 (15 mins) expire = 604800 (7 days) default TTL = 86400 (1 day) ------------ ------------ Got answer: HEADER: opcode = QUERY, id = 8, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 5, authority records = 0, additional = 0 QUESTIONS: google.com, type = A, class = IN ANSWERS: -> google.com internet address = 74.125.225.82 ttl = 161 (2 mins 41 secs) -> google.com internet address = 74.125.225.81 ttl = 161 (2 mins 41 secs) -> google.com internet address = 74.125.225.84 ttl = 161 (2 mins 41 secs) -> google.com internet address = 74.125.225.80 ttl = 161 (2 mins 41 secs) -> google.com internet address = 74.125.225.83 ttl = 161 (2 mins 41 secs) ------------ Non-authoritative answer: ------------ Got answer: HEADER: opcode = QUERY, id = 9, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: google.com, type = AAAA, class = IN AUTHORITY RECORDS: -> google.com ttl = 474 (7 mins 54 secs) primary name server = ns1.google.com responsible mail addr = dns-admin.google.com serial = 1467440 refresh = 7200 (2 hours) retry = 1800 (30 mins) expire = 1209600 (14 days) default TTL = 300 (5 mins) ------------ Name: google.com Addresses: 74.125.225.82 74.125.225.81 74.125.225.84 74.125.225.80 74.125.225.83 >If use . on the end like google.com. then it doesn't do that
C:\>nslookup Default Server: pfsense.local.lan Address: 192.168.1.253 > google.com. Server: pfsense.local.lan Address: 192.168.1.253 Non-authoritative answer: Name: google.com Addresses: 74.125.225.83 74.125.225.84 74.125.225.81 74.125.225.82 74.125.225.80 > set debug > google.com. Server: pfsense.local.lan Address: 192.168.1.253 ------------ Got answer: HEADER: opcode = QUERY, id = 4, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 5, authority records = 0, additional = 0 QUESTIONS: google.com, type = A, class = IN ANSWERS: -> google.com internet address = 74.125.225.83 ttl = 291 (4 mins 51 secs) -> google.com internet address = 74.125.225.84 ttl = 291 (4 mins 51 secs) -> google.com internet address = 74.125.225.81 ttl = 291 (4 mins 51 secs) -> google.com internet address = 74.125.225.82 ttl = 291 (4 mins 51 secs) -> google.com internet address = 74.125.225.80 ttl = 291 (4 mins 51 secs) ------------ Non-authoritative answer: ------------ Got answer: HEADER: opcode = QUERY, id = 5, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: google.com, type = AAAA, class = IN AUTHORITY RECORDS: -> google.com ttl = 428 (7 mins 8 secs) primary name server = ns1.google.com responsible mail addr = dns-admin.google.com serial = 1467441 refresh = 7200 (2 hours) retry = 1800 (30 mins) expire = 1209600 (14 days) default TTL = 300 (5 mins) ------------ Name: google.com Addresses: 74.125.225.83 74.125.225.84 74.125.225.81 74.125.225.82 74.125.225.80 >Now you could turn off the use of search suffixes, but then would not allow you to do a dns query via just host name, like so
C:\>nslookup Default Server: pfsense.local.lan Address: 192.168.1.253 > p4-28g Server: pfsense.local.lan Address: 192.168.1.253 Name: p4-28g.local.lan Address: 192.168.1.4 > set debug > p4-28g Server: pfsense.local.lan Address: 192.168.1.253 ------------ Got answer: HEADER: opcode = QUERY, id = 4, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: p4-28g.local.lan, type = A, class = IN ANSWERS: -> p4-28g.local.lan internet address = 192.168.1.4 ttl = 3600 (1 hour) ------------ ------------ Got answer: HEADER: opcode = QUERY, id = 5, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 0, authority records = 0, additional = 0 QUESTIONS: p4-28g.local.lan, type = AAAA, class = IN ------------ Name: p4-28g.local.lan Address: 192.168.1.4See how it auto added my local.lan to the search
Now there is a group policy or reg key you can set to turn this control this functionality atleast for users of the dnsclient, like ping and browser, etc. But nslookup is not effected – if you do not want nslookup to use your suffix and or search suffixes, etc. then just end the query with . like in my above example.
Here is info on that reg key entry
http://blogs.technet.com/b/networking/archive/2009/04/16/dns-client-name-resolution-behavior-in-windows-vista-vs-windows-xp.aspx
DNS Client Name Resolution behavior in Windows Vista vs. Windows XPHKLM\Software\Policies\Microsoft\Windows NT\DNSClient\AppendToMultiLabelName
Hope that helps!
-
That happens most often when your domain has wildcard DNS active.
The way DNS works, as laid out above, your search domain is appended before it queries farther up. Because you have wildcard DNS on, that returns a valid response.
Without wildcard DNS, the entry does not exist, and it moves on to trying a higher level.
