I want to make a relative path DNS query with dig. I have referenced the following documentation for dig(1) and resolv.conf(5).
dig(1) says:
+ndots=D
Set the number of dots that have to appear in name to D for it to be considered absolute. The default value is that defined using
the ndots statement in /etc/resolv.conf, or 1 if no ndots statement is
present. Names with fewer dots are interpreted as relative names and
will be searched for in the domains listed in the search or domain
directive in /etc/resolv.conf.
resolv.conf(5) says:
domain Local domain name.
Most queries for names within this domain can use short names relative
to the local domain. If set to '.', the root domain is considered.
If no domain entry is present, the domain is determined from the local
hostname returned by gethostname(2); the domain part is taken to be
everything after the first '.'. Finally, if the hostname does not
contain a domain part, the root domain is assumed.
My /etc/resolv.conf:
options timeout:2 attempts:3 rotate single-request-reopen
; generated by /usr/sbin/dhclient-script
domain nonexist.com
nameserver 100.100.2.136
nameserver 100.100.2.138
But running dig abc on a CentOS Linux release 7.6.1810 (Core) 64 bit OS results:
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> abc
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13347
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;abc. IN A
;; AUTHORITY SECTION:
abc. 9080 IN SOA ac1.nstld.com. info.verisign-grs.com. 1573282493 1800 900 604800 86400
;; Query time: 0 msec
;; SERVER: 100.100.2.136#53(100.100.2.136)
;; WHEN: Sat Nov 09 15:23:42 CST 2019
;; MSG SIZE rcvd: 99
My expection is that abc should be suffixed with nonexist.com. and abc.nonexist.com. is used in the DNS query. But the above QUESTION SECTION has abc. instead of abc.nonexist.com.
Can anyone point out what is wrong with my setup?
dig(1) says:
+[no]search
Use [do not use] the search list defined by the searchlist or domain directive in resolv.conf (if any). The search list is not
used by default
Related
I would like to enable SSL for my domain assigned to the wordpress in Azure.
My domain is created in Freenom.
To finish the process I need to manually verify the domain from Azure:
Azure Domain Verification
Then I created TXT record in my domain in Freenom:
Freenom provider settings
But the TXT record is not created:
$ dig nemoz.ml TXT
; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> nemoz.ml TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29489
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0005 , udp: 4096
;; QUESTION SECTION:
;nemoz.ml. IN TXT
;; ANSWER SECTION:
nemoz.ml. 5 IN CNAME nemoz.azurewebsites.net.
nemoz.azurewebsites.net. 5 IN CNAME waws-prod-am2-203.sip.azurewebsites.windows.net.
waws-prod-am2-203.sip.azurewebsites.windows.net. 5 IN CNAME waws-prod-am2-203.cloudapp.net.
;; AUTHORITY SECTION:
cloudapp.net. 5 IN SOA prd1.azuredns-cloud.net. msnhst.microsoft.com.cloudapp.net. 2110897293 900 300 604800 60
;; Query time: 299 msec
;; SERVER: 192.168.47.2#53(192.168.47.2)
;; WHEN: Tue Oct 02 16:56:54 EDT 2018
;; MSG SIZE rcvd: 250
And I am not able to verify the domain from Azure. I tried many configurations in Freenom, using networking tools, and searched many web pages. And nothing working.
Can you please help me find the problem?
It works!
I removed CNAMEs from Freenom and now I get TXT record:
$ dig nemoz.ml TXT
; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> nemoz.ml TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26447
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0005 , udp: 4000
;; QUESTION SECTION:
;nemoz.ml. IN TXT
;; ANSWER SECTION:
nemoz.ml. 5 IN TXT "phkg1hlljofbujbrfvl8pe8l62"
nemoz.ml. 5 IN TXT "nemoz.azurewebsites.net"
;; Query time: 1677 msec
;; SERVER: 192.168.47.2#53(192.168.47.2)
;; WHEN: Wed Oct 03 03:33:42 EDT 2018
;; MSG SIZE rcvd: 112
Also in Azure the domain verification is successful. Thanks a lot.
But the question is why is that? Why CNAME record prevents TXT record in domain?
Make sure you type the correct TXT record format in your domain DNS zone. named # with a valid value ph*********62in Freenom provider. And wait a few minuies for DNS propagation.
Here is an example in Azure DNS.
In Freenom replace 1examplevalue1 with the token ph*********62.
One possible problem can be that you have two TXT records with the same value.
For some reason it causes a conflict and records won't take effect.
I'm building a custom DNS Server that, among other things, serves SRV records and associated A and AAAA records. I can verify that querying the server directly returns the expected answer:
$ dig lseed.bitcoinstats.com SRV #139.59.143.87 +short
10 10 9735 2c932136c294204bc65c73266300b30fe8ccb99c24fb2261d2e9980a7e8ffe9.80.lseed.bitcoinstats.com.
10 10 6331 31ce6a2b947fdbc97f10405c4062848393cf8140f33cc492aa044fe47d18f59.c6.lseed.bitcoinstats.com.
10 10 8334 283a918ae4609473c01f2e19491e9202788150dbe8d4361a3a04f3a879e9f0a.45.lseed.bitcoinstats.com.
10 10 53258 2673073e3751681b0c55aa88e5af17522c6d6b32d7d210bf4d65439d063c1ba.91.lseed.bitcoinstats.com.
However when querying through my ISPs resolver (or any of the public resolvers, like Google's 8.8.8.8) I get an empty answer back:
$ dig lseed.bitcoinstats.com SRV #8.8.8.8
; <<>> DiG 9.9.5-3ubuntu0.10-Ubuntu <<>> lseed.bitcoinstats.com SRV #8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 10994
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;lseed.bitcoinstats.com. IN SRV
;; Query time: 86 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Nov 29 12:32:15 CET 2016
;; MSG SIZE rcvd: 51
The query returns immediately and I can see that my server receives an incoming query, however it is empty. Is it known behavior that the resolver strips SRV and additional answers? If this were the case, why is the query being forwarded at all to my server? Or is the error on my side, and the server simply replies with an incorrect answer?
Turns out that the answers were stripped due to non-matching names in the answer. The query was asking for lseed.bitcoinstats.com while the answers were replying with another domain (_lightning._tcp.lseed.bitcoinstats.com) hence the resolvers were stripping the non-matching answers, leaving just an empty reply with no answers. Setting the domain in the answers equal to the domain in the question results in resolvers passing the answers through.
dig redhat.com
;; QUESTION SECTION:
;redhat.com. IN A
;; ANSWER SECTION:
redhat.com. 3600 IN A 209.132.183.105
We get the ip address 209.132.183.105----the A record of domain redhat.com.
Now i want to get the domain name from the ip--209.132.183.105.
Maybe you introduce two ways to get it.
nslookup 209.132.183.105
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
105.183.132.209.in-addr.arpa name = redirect.redhat.com.
Authoritative answers can be found from:
dig -x 209.132.183.105
; <<>> DiG 9.9.5-9+deb8u7-Debian <<>> -x 209.132.183.105
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62599
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;105.183.132.209.in-addr.arpa. IN PTR
;; ANSWER SECTION:
105.183.132.209.in-addr.arpa. 519 IN PTR redirect.redhat.com.
;; Query time: 1 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sat Nov 19 15:11:33 CST 2016
;; MSG SIZE rcvd: 90
It is unlucky taht the result is not redhat.com and redirect.redhat.com is a PTR record with 209.132.183.105.
Could i draw a conclusion that no way to get a domain name from the IP address in condition of that the ip is A record of domain name?
You are correct in that there is no way to get the info reliably.
Anyone who owns a domain name can point any A, AAAA or CNAME to whatever IP address they like irrespective if they control that IP address.
It gets even more complex in that if you have the reverse delegation set up for your IP address(es) you can set whatever PTR record you like - even stuff that's invalid or none existent.
If you owned the domain rubber-chickens.com there is nothing stopping you creating the following;
google.rubber-chickens.com A 216.58.210.36 - Which points to google or
200.200.120.11 PTR msn.microsoft.com. - Which when you did a traceroute or dig would appear to show the hostname msn.microsoft.com
IP's and domains are just made up in this example.
As part of a project I've written a very simplistic DNS server whose only purpose is to resolve queries for the zone it serves, and to store the IP addresses of the server that made the query.
I've noticed that if I use dig, my DNS server gets queried multiple times - sometimes from the same IP address. Why does this happen? Is it due to the unreliable nature of UDP?
For example, here's a dig reply I made:
C:\Data>dig xyz.dns.example.com
; <<>> DiG 9.10.4-P2 <<>> xyz.dns.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2539
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;xyz.dns.example.com. IN A
;; ANSWER SECTION:
xyz.dns.example.com. 12321 IN A 50.16.166.175
;; Query time: 224 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Thu Aug 11 15:07:42 Eastern Daylight Time 2016
;; MSG SIZE rcvd: 77
In this example, the zone file for example.com has an NS record for dns.example.com which is where my simplistic DNS server runs. Fror this one query, my server was called 4 times from 2 different IP addresses.
I also noticed that I'm supposedly returning an "Additional" record, but the data I return in bytes 10 and 11 are clearly 0. Could this be causing a problem?
Try dig's +trace option:
dig example.com +trace
When I run the following dig command on www.google.com with the +nssearch option I get no results:
mac$ dig www.google.com +nssearch
mac$
Can someone explain why no data is returned here? The +nssearch option reads the SOA of all the authoritative name servers I believe. Does this mean there are no authoritative name servers? How is that possible? The domain www.google.com obviously works so I was expecting some sort of result.
; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40522
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.google.com. IN A
;; ANSWER SECTION:
www.google.com. 20 IN A 74.125.196.106
www.google.com. 20 IN A 74.125.196.104
www.google.com. 20 IN A 74.125.196.99
www.google.com. 20 IN A 74.125.196.147
www.google.com. 20 IN A 74.125.196.105
www.google.com. 20 IN A 74.125.196.103
;; Query time: 2 msec
;; SERVER: 192.168.186.1#53(192.168.186.1)
;; WHEN: Wed Jun 17 17:17:37 CDT 2015
;; MSG SIZE rcvd: 139
From "man dig":
+[no]nssearch
When this option is set, dig attempts to find the authoritative name servers for the zone containing the name being
looked up and display
the SOA record that each name server has for the zone.
Since there's no authority section in the response, +nssearch is going to return nothing.
www.google.com is not a zone, but a name in a zone. Therefore it doesn't have any NS records (or SOA records) for dig to display. Try dropping the www. bit and you'll get more output.