Link to home
Start Free TrialLog in
Avatar of stdcitunit
stdcitunitFlag for New Zealand

asked on

Website resolving to incorrect IP

Hi Experts,

We have a Windows Server 2003 DNS server, with Windows XP Clients on a Domain.

For the most part, our internet and DNS ventures are fine, bar this one site:

For the sake of not using real names etc i will say www.google.com

So a while ago, www.google.com worked ok, then suddenly google changed their IP address. This is when the problem started. We think that our DNS server has not changed its record for google, as we can still access the site by its 'true' IP address. When we ping google from a client, it shows up as the old IP address (that does not work) but if we enter the new address in the browser, it works ok.

I am not very knowledgable on DNS at this stage, and i was unable to locate a list of stored sites or anything to veify that www.google.com is stored as an incorrecft IP.

Any help would be much appreciated

Thanks in advance

Adam
Avatar of Burns2007
Burns2007

from an affected workstation, open a command prompt and type ipconfig /flushdns
try to access teh website again. This will see if it is a problem locally cached on the workstation.


If this still fails, log on to the DNS server and open up dns management.
Expand the server > Cached Lookups > .root
Go down through here until you find the site record (eg com > google > www) and delete the record.

Do a ipconfig /flushdns on a workstation again and look it up, the DNS server should go to it's DNS forwarder/root servers and get teh address again.
Avatar of Kutyi
On your DNS server try to clear the Cache.  Right click you DNS server in the DNS management Console and select clear cache
Avatar of stdcitunit

ASKER

Hey guys, thank you for your suggestions

Burns2007: using ipconfig /flushdns on several computers and still getting the same problem. Checked on the server in DNS management, and under cached lookups > .root etc all these are empty, there are no records? I have attached a screenshot for reference.

Kutyi: Tried clearing the cache, then ipconfig /flushdns, still getting the same problem.
screen01.JPG
Are you able to access the site from other locations?  Its possible they change ISP's or something and never had the old ISP stop answering the DNS lookups.  Do you have forwarders set on your DNS servers?
icorps: Yes, i am able to access the site from other locations. I have tried my computer at home (different ISP) and i have tried from a wireless aircard (same ISP) - from these other locations, the site works ok. This site does seem to have changed it's IP address about 3 times in the last 6 months, but shouldn't our DNS server update with this?

Yes we have forwarders (or entries under here) but these only point to local stuff (machines inside our network).



ASKER CERTIFIED SOLUTION
Avatar of Burns2007
Burns2007

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
As a test, I'd suggest removing the forwarders.  Or perform an nslookup and try specifying each of the forwarders to see if one of them might respond with the incorrect address.
Burns2007: Did you mean clear the cache as Kutyi suggested? If so, i have already done that to no avail. If this is not what you mean, please explain more about 'if so check the cache on the DNS management console...".

icorps: Please explain more about forwarders, and steps to get to there? I have attached another screen that i got to by clicking on DC03, then clicking on Forwarders:

Thanks heaps all for the responses so far, i am learning a lot about DNS and look forward to resolving this issue.
screen02.JPG
See if this site is listed in the C:\WINDOWS\system32\drivers\etc\HOSTS file.
This file overrides DNS
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I have checked on both the server and the client(s) hosts files (under c:\windows\system32\drivers\etc) and there are no entried (only the 127.0.0.1 localhost default one). Any suggestions where to go from here guys?

Also as a side note (which may help my understanding and maybe help solve the problem?) how can i view a list of records that are stored in my DNS server's 'cache' - i would really like to identify the record, view it and prove that it is wrong, rather than relying on ping tests etc. Is this possible?
You test name resolution with nslookup to be sure that it's a dns issue. Just start nslookup from a command prompt and type www.google.com, does it give the right ip?

I don't know how to see the DNS server cache, but you could right-click on it and "clear cache"

I suspect that the default root hints are directing your DNS server to an out-of-date DNS server somewhere. You should get the recommended DNS servers from you ISP and add them as forwarders.
Hi Laserspot,

The result i get from nslookup is:

-------------------------------------------------------
Server: dc03.mydomain.com
Address: 10.202.1.19

*** dc03.mydomain.com can't find www.google.com: Server failed
-------------------------------------------------------


Also i have tried to 'clear cache' as suggested in previous posts, but to no avail.

I will try the last suggestion about adding as forwarders and see how that goes.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Just out of curiosity, is the first record in your zone file on your DNS a . (yes period)  If so your DNS may think it is a Root server and therefor not requesting from www root servers.  This record should not be there.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hi guys,

I have not had time to action this since, as our network administrator has left and we have been very busy picking up with his role until it is filled.

Thank you very much for your input, and i really appreciate the comments and time you have all put in to this, and feel bad that i have to close it like this. But i do understand that people don't like these questions hanging around, and i will take the responsibility and close it.

Thanks again all,

Adam
As posted previously
Thanks Adam, If the suggestions get you through your issue then Great, if not repost and we will be here.  .....:)