DNS issue

[bullz]

Hello all,

Greetings.!

Note: windows is the DNS server.

One of my application fully depend on DNS. “xyz.com” should be resolved only by DNS to make this application work.
Somehow I managed to add the details into my DNS server (windows) and it’s resolving too.

But, unfortunate that, my application is trying to resolve DNS by checking for “Non-authoritative answer”
(below script is checking for DNS o/p)

if $NSLOOKUP $TESTDOMAIN | grep -i "$ANSWER"
(nslookup xyz.com | grep –i “Non-authoritative answer”)

But I am not finding any term called “Non-authoritative answer” while doing nslookup.

But I am getting “Non-authoritative answer” in other server which DNS server (unknown OS, not under my control) is different.

If so, what is “Non-authoritative answer” and how to configure this.

[Larry Klasmier]

Non-Authoritative answer just mean the data is cached on the server in question and nslookup is not actually contacting the DNS server. Clear the cache

[Matti_Kurkela · Accepted solution]

> Somehow I managed to add the details into my DNS server (windows) and itâ s resolving too.

Did you make your Windows DNS server authoritative for xyz.com? If so, did you make it a slave of the real xyz.com master DNS server (so your server gets a full, up-to-date copy of xyz.com DNS records)?

Or did you just make it a rogue fake-master server for xyz.com, with records that may or may not match the true xyz.com records, and are unlikely to be updated when the true xyz.com is? That would be a stupid thing to do.

If your Windows DNS server is allowed to contact other DNS servers on the Internet, you should not need to do anything special to resolve xyz.com (assuming that the xyz.com domain really exists).

If xyz.com is totally unknown to your DNS server, your server will first contact the Internet root nameservers to get the list of .com top-level domain nameservers. When it gets that list, it picks one of the servers from the list and sends that server a request for xyz.com domain nameservers. All these intermediate answers are cached, so if you later need information on some other .com domain, there will be no need to consult the root nameservers again.

If there are more domain levels, this process can repeated for every domain level as necessary. Eventually your DNS server will know the address of the authoritative name server(s) for xyz.com, and will ask them the information you originally requested (the IP address of xyz.com). As this information is received directly from the authoritative server, it is known as an "authoritative answer". It comes with a Time-To-Live value, which works like an expiration date, although it's measured in seconds, not days.

Your Windows DNS server will cache this answer, in case you need it later.

When you request the IP address of xyz.com again, your Windows DNS server will already have the data in its cache. It checks the TTL value: if the data is still valid, the DNS server can just give you the answer without making any requests to any other DNS server. This improves response time and saves network bandwidth. In this case, the answer will be labelled a "non-authoritative answer", because it came from a cache.

If the data in the cache was expired, your DNS server would request it again from the xyz.com nameserver.

So, the lack of "Non-authoritative answer" in nslookup output even when the query is repeated can mean one of two things:

a) Your local DNS server is configured as a slave of the xyz.com DNS zone. This is "premium service" (if done correctly) and a good thing for you.

b) Your local DNS server is unable to cache the xyz.com DNS information for some reason, and it must always request it from the authoritative xyz.com server. This means your local DNS server is overloaded or fails in some other way. This is bad.

If the application is not specifically related to the maintenance of the xyz.com DNS zone, checking for "non-authoritative answer" is pretty silly. It probably doesn't work like the author of the application thought it would.

What would happen if the application got a non-authoritative answer? What happens if it does not get it?

MK

[Bill Hassell]

You might want to look at the output from nsquery rather than nslookup. nslookup's output lines can vary depending on what the resolver has to do. nsquery seems more complete and with each of the steps listed as well as the nsswitch.conf rules:

nsquery hosts xyz.com
nsquery hosts 12.34.56.78

[bullz]

*********************************************

Your local DNS server is unable to cache the xyz.com DNS information for some reason, and it must always request it from the authoritative xyz.com server. This means your local DNS server is overloaded or fails in some other way. This is bad.

*********************************************

Yes, looks to be my DNS server (windows 2003) is not able to cache. Also to add on, I have only one DNS server, there is no secondary for this.
Could anyone help me, how to setup this cache option in DNS?

[bullz]

I am geting the error as below.

"Unable to look up any DNS SRV records for domain:"

[Rita C Workman]

It may be that whoever controls that other DNS server has the authority to set up SRV records....to quote " preference based specification of the availability of services within a domain [RFC2782]." Sounds like there is SRV records in place...

I'm no DNS guru, but .. DNS MX records can be set up to make use of SMTP protocol to control the priority of inbound connections.

Isn't SRV just another DNS kind of record that based on the info above, could set up that may be impacting you?

Maybe you need to talk to the person who 'really' is controlling the DNS servers and see if somehow you're not set up quite right & getting blocked somehow when you are hitting that first DNS server you mentioned.

Just a thought,
Rita

[Rita C Workman]

.. or as you said in the beginning ..
>> But I am not finding any term called â Non-authoritative answerâ while doing nslookup.

So...can you just change your resolv.conf to head over to that DNS server first, instead of the one your using?

/rcw

[bullz]

I am new to DNS server side, there are total of 2 zone files which is related to active directory
But the zone (xyz.com) which I have created is not part of active directory.

I just went to primary zone and added host in it. Could some DNS experts assist me for SRV record.

[Horia Chirculescu]

Hello,

>if $NSLOOKUP $TESTDOMAIN | grep -i "$ANSWER"
(nslookup xyz.com | grep â i â Non-authoritative answerâ )

I believe grep-ing for "Non-Authoritative answer" is wrong in this context.

You should check for "Name", modify your script like this::

ANSWER="Name"

if $NSLOOKUP $TESTDOMAIN | grep -i "$ANSWER"

This should work as expected, regrdless the fact that the data is cached or not on the DNS.


Horia.