I guess this is more of a philosophical question.

Records have changed, but only dig seems to see the new one. ssh/ping and such use the old address.

The TTL of the record dig sees is also ticking correctly.

Is this really the nameserver responding differently or just a hidden DNS cache?

$ host -v boing
Trying "boing"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7276
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;boing.             IN      A

boing.      1213    IN      CNAME   ec2-52-209-211-218.eu-west-1.compute.amazonaws.com.
ec2-52-209-211-218.eu-west-1.compute.amazonaws.com. 514066 IN A

Received 112 bytes from in 1 ms


$ dig @ boing

; <<>> DiG 9.10.4-P2 <<>> @ boing
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34806
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

; EDNS: version: 0, flags:; udp: 1232
;boing.             IN      A

boing.      3441    IN      CNAME   ec2-52-211-117-189.eu-west-1.compute.amazonaws.com.
ec2-52-211-117-189.eu-west-1.compute.amazonaws.com. 604641 IN A

;; Query time: 1 msec
;; WHEN: Sat Sep 24 12:08:50 CEST 2016
;; MSG SIZE  rcvd: 123
  • What cat /etc/resolv.conf does return? It's possible that your OS uses dnsmasq as a DNS caching service. – Huygens Sep 24 '16 at 17:12
  • @Huygens no dnsmasq, both programs use for DNS – Banyoghurt Sep 26 '16 at 10:11
  • Sadly it goes behind my expertise then :-( If no one can help you, I can give you a further hint: run tcpdump to capture the dns flow for both queries and answers. See if anything in the queries are different, if you have a difference, then you might find out why (via some googling possibly). I would execute this: sudo tcpdump -w ~/dns.pcap -s 0 -i any udp port 53 This will generate a file dns.pcap in your home directory. You can open it using a tool such as Wireshark (wireshark.org). – Huygens Sep 27 '16 at 7:55
  • I did a test on my CentOS box,the DNS query did correctly reach both a unique name server and both returned the same IP address. However dig set one flag (the AD bit for authenticated data) in the query, whereas host did not set it, and dig set the additional records of type OPT (for DNSSEC AFAIK) but did not set the DO bit, so AFAIK it stated that it can't handle DNSSEC extension. Apart from that both queries where identical. – Huygens Sep 27 '16 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.