I have a Linux box (Ubuntu server 11.10) inside a Windows Active Directory domain, and is joined the domain using likewise-open. The
resolv.conf file looks like this:
domain mydomain.com nameserver 192.168.1.1 nameserver 184.108.40.206 nameserver 220.127.116.11
192.168.1.1 is the Windows DNS server for the Windows domain.
18.104.22.168 are Google's public DNS servers that we preferred over our ISP servers.
That setup was working properly, until we decided to disable recursion in the Windows DNS server due to some changes of our network design. I thought that will go well as we have configured it to use Google's servers next, but it seems not:
mydomain\myuser@linux-server:~$ dig google.com ; <<>> DiG 9.7.3 <<>> google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55321 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;google.com. IN A ;; AUTHORITY SECTION: . 3600 IN NS c.root-servers.net. . 3600 IN NS d.root-servers.net. . 3600 IN NS e.root-servers.net. . 3600 IN NS f.root-servers.net. . 3600 IN NS g.root-servers.net. . 3600 IN NS h.root-servers.net. . 3600 IN NS i.root-servers.net. . 3600 IN NS j.root-servers.net. . 3600 IN NS k.root-servers.net. . 3600 IN NS l.root-servers.net. . 3600 IN NS m.root-servers.net. . 3600 IN NS a.root-servers.net. . 3600 IN NS b.root-servers.net. ;; ADDITIONAL SECTION: c.root-servers.net. 3600 IN A 22.214.171.124 d.root-servers.net. 3600 IN A 126.96.36.199 e.root-servers.net. 3600 IN A 188.8.131.52 f.root-servers.net. 3600 IN A 184.108.40.206 ;; Query time: 4 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Wed Jan 8 14:02:22 2014 ;; MSG SIZE rcvd: 507
mydomain\myuser@linux-server:~$ ping google.com ping: unknown host google.com
And also I have failed squid proxy connections (which I solved using the dns_nameservers option inside squid configuration and neglected the internal DNS server).
Why DNS requests fails when recursion is declined by the first nameserver? Shouldn't the machine tries the next server? And what can I do if that was the expected (designed) behavior?
EDIT: NSLOOKUP gave other (success) results:
mydomain\myuser@linux-server:~$ nslookup google.com ;; Got recursion not available from 192.168.1.1, trying next server Server: 220.127.116.11 Address: 18.104.22.168#53 Non-authoritative answer: Name: google.com Address: 22.214.171.124 Name: google.com Address: 126.96.36.199 Name: google.com Address: 188.8.131.52 Name: google.com Address: 184.108.40.206 Name: google.com Address: 220.127.116.11 Name: google.com Address: 18.104.22.168
So is this application-dependent? Can I get that (trying next server if the first refuses recursion) to work transparently for all applications requesting name resolution, or name resolution is the responsibility of the program itself? (or am I missing something?!)...
EDIT: Also worth noting,
mydomain.com is a registered and public address on the internet and is not owned by us. It's like we've set up an internal domain named
apple.com, and I assure you I don't work for Apple, at least not yet ;-).