Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a simple install with Debian as a guest in Virtualbox. I installed the resolvconf package. The resolv.conf file is this:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
nameserver 10.3.x.x
nameserver 10.219.x.x

I added nameservers through GUI (Applications/System Tools/Network Tools).

The is Google's DNS, and I want to use it to resolve internet addresses. The 10.3.x.x and 10.219.x.x are needed to resolve internal domains like teleportal.company.intra.

When I have these nameservers in resolv.conf(and is the first) I get an error when querying internal an address:

> host teleportal.company.intra           
Host teleportal.company.intra not found: 3(NXDOMAIN)

However if I explicitly set the second nameserver's address as a nameserver for nslookup, it works:

» nslookup teleportal.company.intra 10.3.x.x
Server:     10.3.x.x
Address:    10.3.x.x#53

teleportal.company.intra    canonical name = proxy.dummy1.dummy2.private.
Name:   proxy.dummy1.dummy2.private
Address: 172.27.x.x
Name:   proxy.dummy1.dummy2.private
Address: 172.27.x.x

The resolv.conf documentation states that the nameserver entries will be tried in order, if one of them cannot resolve the query. However if I turn debug on when using nslookup I see that nslookup does not even try other entries, only the first.

If I change the order of the nameservers, then internal addresses will be resolved properly (nslookup still uses only the first entry).

How can I set up 3 nameservers so that utilities will use all of them in order?

share|improve this question
"Tries each server in order" means that it tries one after another until it gets an answer in case one of them doesn't respond. It doesn't mean that if it gets a conclusive "There's no such animal" response it asks for a second opinion. – Shadur Apr 8 '12 at 10:42
up vote 7 down vote accepted

The resolv.conf list of nameservers is contacted one after the other only in case of timeout. Not when one nameserver authoritively says "there is no such domain" (NXDOMAIN). In your case the DNS apparently does not know about teleportal.company.intra and the resolver stopped when it got the NXDOMAIN.

If possible you should configure one DNS server and use it for all your resolution and let the DNS server decide how to resolve the name. If 10.3.x.x is your intranet DNS server it would likely be able to resolve the internet hostnames as well.

Having said that, if you really want to relay the requests to different DNS servers based on the names you could try pdnsd. Its a caching DNS proxy program that one would run locally. Install it (apt-get install pdnsd) and add your localhost ( to resolv.conf. In the pdnsd.conf configuration file you can specify which DNS servers to contact based on name matching. An example paragraph for your /etc/pdnsd.conf:

server {
    label= "google";
    exclude = ".company.intra";
    ip =;

server {
    label= "intra";
    include = ".company.intra";
    ip = 10.3.x.x;

I've snipped out many other parameters in the above file. You should follow the documentation and the example config file that ships with debian package to setup your pdnsd.conf.

share|improve this answer
dnsmasq can do this too. – ephemient Apr 8 '12 at 19:57

I think that the resolver falls back to secondary (or tertiary or ...) DNS only if the first (or second or ...) fails.

In this case the query doesn't fail, it correctly returns NXDOMAIN, i.e. the domain name doesn't exist.

If you really want to use Google's DNS (or any other DNS for that matter) to resolve external domains (instead of your internal nameservers), you can configure your servers 10.3.x.x and 10.219.x.x to be authoritative for your internal names only and to forward all the other queries to external DNS, then use your internal nameservers as your only nameservers on your internal computers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.