[MrCaps]

Hello

I have an interesting one.

We use internal DNS servers that are configured to look-up by directly querying the root hints. DNS Forwarding is not used.

They work fine and normally never miss a beat. However, a problem was found by one of end users. They can not resolve the name www.jetstar.com.au

I do a NSLOOKUP on our DNS servers and it returns the address is unknown. I switch the NSLOOKUP to one of the main ISP servers in Australia and it returns an IP fine.

I don't want to switch the servers to forwarding as this is a big company and I can't just do that, so please don't suggest it.

I'm really baffled as to why this is happening. Can someone give some pointers to get me going so I can resolve this issue, or at least understand why it is happening.

Cheers

Mr Caps

[sniksahs]

Probably Richard Branson trying to drum up business by blocking the competition!!!

[guyt]

try to examine the output of nslookup in debug mode.

do:

c:>nslookup
set d2
www.jetstar.com.au

you will see the DNS query flow.
if still in trouble, paste the output here and I will try to see if I can spot anything.

[MrCaps]

Hi

This is the output.

I'm guessing from what I see the COMPANY.com.au is being appended to www.jetstar.com.au.

I'm also guessing that this is originating from the client setting appending the DNS suffix in the TCP/IP settings in the network stack. Still testing this idea.

What do you think?

> set d2
> www.jetstar.com.au
Server: DNSSERVER.COMPANY.com.au
Address: 172.19.22.37

------------
SendRequest(), len 47
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.jetstar.com.au.COMPANY.com.au, type = A, class = IN

------------
------------
Got answer (112 bytes):
HEADER:
opcode = QUERY, id = 2, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
www.jetstar.com.au.COMPANY.com.au, type = A, class = IN
AUTHORITY RECORDS:
-> COMPANY.com.au
type = SOA, class = IN, dlen = 43
ttl = 3600 (1 hour)
primary name server = DNSSERVER.COMPANY.com.au
responsible mail addr = COMPANY.com
serial = 845980
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)

------------
------------
SendRequest(), len 43
HEADER:
opcode = QUERY, id = 3, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.jetstar.com.au.com.au, type = A, class = IN

------------
------------
Got answer (118 bytes):
HEADER:
opcode = QUERY, id = 3, rcode = NXDOMAIN
header flags: response, auth. answer
questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
www.jetstar.com.au.com.au, type = A, class = IN
AUTHORITY RECORDS:
-> com.au
type = SOA, class = IN, dlen = 63
ttl = 86400 (1 day)
primary name server = ns1.ausregistry.net
responsible mail addr = dns.ausregistry.net.au
serial = 2005455722
refresh = 14400 (4 hours)
retry = 3600 (1 hour)
expire = 3600000 (41 days 16 hours)
default TTL = 86400 (1 day)

------------
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 4, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.jetstar.com.au, type = A, class = IN

------------
DNS request timed out.
timeout was 2 seconds.
timeout (2 secs)
SendRequest failed
*** Request to DNSSERVER.COMPANY.com.au timed-out
>

[MrCaps]

Actually scratch my last comment. It is stepping down through the suffixes. A similar search on Yahoo will do exactly the same thing and then resolve at the end.

Originally Posted by MrCaps

Hi

This is the output.

I'm guessing from what I see the COMPANY.com.au is being appended to www.jetstar.com.au.

I'm also guessing that this is originating from the client setting appending the DNS suffix in the TCP/IP settings in the network stack. Still testing this idea.

What do you think?

> set d2
> www.jetstar.com.au
Server: DNSSERVER.COMPANY.com.au
Address: 172.19.22.37

------------
SendRequest(), len 47
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.jetstar.com.au.COMPANY.com.au, type = A, class = IN

------------
------------
Got answer (112 bytes):
HEADER:
opcode = QUERY, id = 2, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
www.jetstar.com.au.COMPANY.com.au, type = A, class = IN
AUTHORITY RECORDS:
-> COMPANY.com.au
type = SOA, class = IN, dlen = 43
ttl = 3600 (1 hour)
primary name server = DNSSERVER.COMPANY.com.au
responsible mail addr = COMPANY.com
serial = 845980
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)

------------
------------
SendRequest(), len 43
HEADER:
opcode = QUERY, id = 3, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.jetstar.com.au.com.au, type = A, class = IN

------------
------------
Got answer (118 bytes):
HEADER:
opcode = QUERY, id = 3, rcode = NXDOMAIN
header flags: response, auth. answer
questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
www.jetstar.com.au.com.au, type = A, class = IN
AUTHORITY RECORDS:
-> com.au
type = SOA, class = IN, dlen = 63
ttl = 86400 (1 day)
primary name server = ns1.ausregistry.net
responsible mail addr = dns.ausregistry.net.au
serial = 2005455722
refresh = 14400 (4 hours)
retry = 3600 (1 hour)
expire = 3600000 (41 days 16 hours)
default TTL = 86400 (1 day)

------------
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 4, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.jetstar.com.au, type = A, class = IN

------------
DNS request timed out.
timeout was 2 seconds.
timeout (2 secs)
SendRequest failed
*** Request to DNSSERVER.COMPANY.com.au timed-out
>