Debugging DNS resolution error

domain-name-systemnetworking

I'm debugging a DNS resolution error for the domain auth.otc.t-systems.com with Cloudflare's server, but got stuck. The strange thing is that the lookup succeeds/fails depending on the machine that runs the query, but I can't figure out where the configuration differs.

The failure is always with following message: server can't find auth.otc.t-systems.com: SERVFAIL

1.1.1.1 is Cloudflare's DNS.

What I've tried so far:

Running nslookup auth.otc.t-systems.com 1.1.1.1 on various machines:
- It fails on my machine with work & home internet (however it succeeds with Google's DNS in both cases).
- It fails on a colleagues machine with work internet.
- It succeeds in a ssh session to a remote server.
Now I would assume that there is some strange configuration on our work internet, that causes the lookup to fail. However I don't know what I should look for and I've also found some online nslookup services that fail as well:
- Fails:
  https://network-tools.com/nslook/Default.asp?domain=auth.otc.t-systems.com&type=1&server=1.1.1.1&class=1&port=53&timeout=5000&go.x=21&go.y=13
- Works: http://www.kloth.net/services/nslookup.php

Any hints how I can further debug this?

Best Answer

Try using dig. Twenty years ago they tried to deprecate nslookup, but its firmly ingrained into muscle memory now and impossible to get rid of, but dig is far superior. For example.

dig +trace auth.otc.t-systems.com @1.1.1.1

Will trace the resolution fully for you, and you can see where they differ.

Related Solutions

DNS Reverse lookup not working

Okay you've said that direct queries against the NS are working and that it's your own ARIN assignment.

Assuming you haven't done so already, you will need to submit a request to ARIN to change the information that they hold for the assignment. Within this block of information are the nameservers delegated to handling reverse DNS for the netblock.

Once you have done this then hosts querying the root servers for ~xxx.in-addr.arpa will know to go to the RIR and then your own nameservers for the correct PTR information.

I can't give you the specific information about the ARIN change request. I'm trained on the other side of the pond and we do things slightly differently here ;)

DNS resolution problems and DNS suffix search order

After reading this I had a look at a Ubuntu 8.10 installation I've just finished on Virtualbox. resolve.conf contains:

# Generated by NetworkManager
domain ourdomain.local
search ourdomain.local
nameserver 192.168.0.6
nameserver 192.168.0.7

As a result, it handles lookups just fine and I can reach any machine with either the host name or the FQDN. My MacBook also handles lookups just fine, both at work and at home, but I'm unable to check its resolve.conf right now (the screen is broken). Neither the work network (Windows DHCP) nor my home network (Linux DHCP) have option 119. In fact both pass the domain name only as option 15.

The only issue I had getting this to work was that Linux and Mac didn't like it when my home network used a single word domain name. Adding ".local" to the end of it is the only change I had to make.

Related Topic