Daniel Adler
asked on
DNS record response from multiple domain
Hi, I seeking for advice on how to find out where I getting from DNS entry (who is the source).
We having multi domain environment here the DNS server's number around 15 and I having difficulty to find out who reporting back specific entry.
Core issue:
Workstations registered to domainA as ws001.domainA.com but for some it looks like also having A record under domainB's DNS (unknown reason) because when I ping the FQDN ws001.domainB.com I also getting response. (shouldn't be like that).
Troubleshooting:
How can I trace back to the source of from where DNS server getting that record ?
Any advice might be helpful.
Thanks
We having multi domain environment here the DNS server's number around 15 and I having difficulty to find out who reporting back specific entry.
Core issue:
Workstations registered to domainA as ws001.domainA.com but for some it looks like also having A record under domainB's DNS (unknown reason) because when I ping the FQDN ws001.domainB.com I also getting response. (shouldn't be like that).
Troubleshooting:
- On the client the configuration looks OK , registered to proper DNS server and proper DHCP server. (OK)
- On DHCP server scope it's pointing to to DNSserver1 (OK)
- NSLOOKUP - answer for ws001.domainB.com coming from DNSserver1.
- On DNSserver1 If I looks under zone domainB there is no record of ws001.domainB.com
- If I check the DNS servers that are in (NS) entries in that zone domainB one by one non of them having this ws001 record.
- No DNS cached on any DNS server holding ws001
- Checked all the 15 DNS servers that under the Name server list - nothing
How can I trace back to the source of from where DNS server getting that record ?
Any advice might be helpful.
Thanks
This question needs an answer!
Become an EE member today
7 DAY FREE TRIALMembers can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
dig +trace ws001.domainA.com
dig +trace ws001.domainB.com
if dig doesn't provide an answer for the second one, then check the hosts files. As nslookup may use those, while dig ONLY uses DNS queries.
If you want to check a specific DNS server then add @DNSserver (DNSserver either by name or by ip address).
default is search for a records, of other records just add the type to the command line
(f.e. soa , a , aaaa, ptr, mx, ns , caa, txt etc. )