3

I'm running Ubuntu 14.04 and I've recently altered some hostname resolving configs. So I'm now trying to optimise them and for that I need to find out which nameservers resolve particular hostnames in my requests.

I can try to ping a hostname my.hostname.example.net to find out if it gets resolved at all or not, but how can I find out which nameserver resolved that particular hostname?

  • 1
    you system should have the dig command – Timothy Truckle Dec 5 '16 at 15:15
4

There are several commands that are useful to debug DNS resolution, and to show the path travelled to resolve DNS lookpups:

  • dnstracer

Install it with:

sudo apt-get install dnstracer

example of usage:

$ dnstracer www.cnn.com
Tracing to www.cnn.com[a] via 193.136.188.1, maximum of 3 retries
193.136.188.1 (193.136.188.1) Got answer [received type is cname] 
 |\___ ns1.fastly.net [fastly.net] (23.235.32.32) 
 |\___ ns4.fastly.net [fastly.net] (104.156.84.32) 
 |\___ ns3.fastly.net [fastly.net] (23.235.36.32) 
  \___ ns2.fastly.net [fastly.net] (104.156.80.32) 
NAME
       dnstracer - trace a chain of DNS servers to the source


DESCRIPTION
       dnstracer determines where a given Domain Name Server (DNS) gets its
       information from, and follows the chain of DNS servers back to the
       servers which know the data.
  • debug mode of nslookup

Example:

$ nslookup
> set debug
> www.cnn.com
Server:     193.136.188.1
Address:    193.136.188.1#53

------------
    QUESTIONS:
    www.cnn.com, type = A, class = IN
    ANSWERS:
    ->  www.cnn.com
    canonical name = turner.map.fastly.net.
    ttl = 191
    ->  turner.map.fastly.net
    internet address = 151.101.36.73
    ttl = 30
    AUTHORITY RECORDS:
    ->  fastly.net
    nameserver = ns2.fastly.net.
    ttl = 13130
    ->  fastly.net
    nameserver = ns3.fastly.net.
    ttl = 13130
    ->  fastly.net
    nameserver = ns4.fastly.net.
    ttl = 13130
    ->  fastly.net
    nameserver = ns1.fastly.net.
    ttl = 13130
    ADDITIONAL RECORDS:
    ->  ns1.fastly.net
    internet address = 23.235.32.32
    ttl = 13130
    ->  ns2.fastly.net
    internet address = 104.156.80.32
    ttl = 13130
    ->  ns3.fastly.net
    internet address = 23.235.36.32
    ttl = 13130
    ->  ns4.fastly.net
    internet address = 104.156.84.32
    ttl = 13130
------------
Non-authoritative answer:
www.cnn.com canonical name = turner.map.fastly.net.
Name:   turner.map.fastly.net
Address: 151.101.36.73
  • dig - trace

Example:

$ dig +trace +recurse +all www.cnn.com. a

; <<>> DiG 9.8.3-P1 <<>> +trace +recurse +all www.cnn.com. a
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37660
;; flags: qr ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13

;; QUESTION SECTION:
;.              IN  NS

;; ANSWER SECTION:
.           456885  IN  NS  j.root-servers.net.
.           456885  IN  NS  k.root-servers.net.
.           456885  IN  NS  l.root-servers.net.
.           456885  IN  NS  m.root-servers.net.
.           456885  IN  NS  a.root-servers.net.
.           456885  IN  NS  b.root-servers.net.
.           456885  IN  NS  c.root-servers.net.
.           456885  IN  NS  d.root-servers.net.
.           456885  IN  NS  e.root-servers.net.
.           456885  IN  NS  f.root-servers.net.
.           456885  IN  NS  g.root-servers.net.
.           456885  IN  NS  h.root-servers.net.
.           456885  IN  NS  i.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net. 543296  IN  A   198.41.0.4
a.root-servers.net. 111296  IN  AAAA    2001:503:ba3e::2:30
b.root-servers.net. 604618  IN  A   192.228.79.201
b.root-servers.net. 111296  IN  AAAA    2001:500:84::b
c.root-servers.net. 604618  IN  A   192.33.4.12
c.root-servers.net. 111296  IN  AAAA    2001:500:2::c
d.root-servers.net. 604618  IN  A   199.7.91.13
d.root-servers.net. 111296  IN  AAAA    2001:500:2d::d
e.root-servers.net. 604618  IN  A   192.203.230.10
f.root-servers.net. 604618  IN  A   192.5.5.241
f.root-servers.net. 111296  IN  AAAA    2001:500:2f::f
g.root-servers.net. 604618  IN  A   192.112.36.4
h.root-servers.net. 604618  IN  A   198.97.190.53

;; Query time: 22 msec
;; SERVER: 10.19.90.11#53(10.19.90.11)
;; WHEN: Mon Dec  5 18:06:06 2016
;; MSG SIZE  rcvd: 496

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16113
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 14

;; QUESTION SECTION:
;www.cnn.com.           IN  A

;; AUTHORITY SECTION:
com.            172800  IN  NS  k.gtld-servers.net.
com.            172800  IN  NS  f.gtld-servers.net.
com.            172800  IN  NS  e.gtld-servers.net.
com.            172800  IN  NS  g.gtld-servers.net.
com.            172800  IN  NS  j.gtld-servers.net.
com.            172800  IN  NS  h.gtld-servers.net.
com.            172800  IN  NS  m.gtld-servers.net.
com.            172800  IN  NS  b.gtld-servers.net.
com.            172800  IN  NS  i.gtld-servers.net.
com.            172800  IN  NS  a.gtld-servers.net.
com.            172800  IN  NS  d.gtld-servers.net.
com.            172800  IN  NS  c.gtld-servers.net.
com.            172800  IN  NS  l.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net. 172800  IN  A   192.5.6.30
b.gtld-servers.net. 172800  IN  A   192.33.14.30
c.gtld-servers.net. 172800  IN  A   192.26.92.30
d.gtld-servers.net. 172800  IN  A   192.31.80.30
e.gtld-servers.net. 172800  IN  A   192.12.94.30
f.gtld-servers.net. 172800  IN  A   192.35.51.30
g.gtld-servers.net. 172800  IN  A   192.42.93.30
h.gtld-servers.net. 172800  IN  A   192.54.112.30
i.gtld-servers.net. 172800  IN  A   192.43.172.30
j.gtld-servers.net. 172800  IN  A   192.48.79.30
k.gtld-servers.net. 172800  IN  A   192.52.178.30
l.gtld-servers.net. 172800  IN  A   192.41.162.30
m.gtld-servers.net. 172800  IN  A   192.55.83.30
a.gtld-servers.net. 172800  IN  AAAA    2001:503:a83e::2:30

;; Query time: 196 msec
;; SERVER: 192.112.36.4#53(192.112.36.4)
;; WHEN: Mon Dec  5 18:06:07 2016
;; MSG SIZE  rcvd: 489

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44429
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 10, ADDITIONAL: 6

;; QUESTION SECTION:
;www.cnn.com.           IN  A

;; AUTHORITY SECTION:
cnn.com.        172800  IN  NS  pdns3.ultradns.org.
cnn.com.        172800  IN  NS  pdns4.ultradns.org.
cnn.com.        172800  IN  NS  pdns1.ultradns.net.
cnn.com.        172800  IN  NS  pdns2.ultradns.net.
cnn.com.        172800  IN  NS  pdns5.ultradns.info.
cnn.com.        172800  IN  NS  pdns6.ultradns.co.uk.
cnn.com.        172800  IN  NS  ns-47.awsdns-05.com.
cnn.com.        172800  IN  NS  ns-576.awsdns-08.net.
cnn.com.        172800  IN  NS  ns-1630.awsdns-11.co.uk.
cnn.com.        172800  IN  NS  ns-1086.awsdns-07.org.

;; ADDITIONAL SECTION:
pdns1.ultradns.net. 172800  IN  AAAA    2001:502:f3ff::1
pdns1.ultradns.net. 172800  IN  A   204.74.108.1
pdns2.ultradns.net. 172800  IN  A   204.74.109.1
pdns2.ultradns.net. 172800  IN  AAAA    2610:a1:1014::1
ns-47.awsdns-05.com.    172800  IN  A   205.251.192.47
ns-576.awsdns-08.net.   172800  IN  A   205.251.194.64

;; Query time: 58 msec
;; SERVER: 192.31.80.30#53(192.31.80.30)
;; WHEN: Mon Dec  5 18:06:07 2016
;; MSG SIZE  rcvd: 445

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47226
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.cnn.com.           IN  A

;; ANSWER SECTION:
www.cnn.com.        300 IN  CNAME   turner.map.fastly.net.

;; Query time: 64 msec
;; SERVER: 204.74.114.1#53(204.74.114.1)
;; WHEN: Mon Dec  5 18:06:07 2016
;; MSG SIZE  rcvd: 64
| improve this answer | |
3

What you need to know is which name servers resolve host names for a particular domain.

As stated, dig is the command you are looking for. If you'd like to know who resolves names for google.com hosts, for example, you should issue the command:

dig google.com ns

which returns the following result:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> google.com ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62331
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      NS

;; ANSWER SECTION:
google.com.             152786  IN      NS      ns4.google.com.
google.com.             152786  IN      NS      ns1.google.com.
google.com.             152786  IN      NS      ns3.google.com.
google.com.             152786  IN      NS      ns2.google.com.

;; Query time: 26 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Mon Dec 05 17:35:07 CET 2016
;; MSG SIZE  rcvd: 111
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.