Duplicate domain name in DNS query

Question

I found out strange duplicate domain name in the DNS queries during tcpdump capturing on my RedHat server. It did not do any impact on my DNS names resolving.

But it's not clear why my server sends such request in DNS query ==> my.domainspec.com.domainspec.com.domainspec.com. In general it should be just my.domainspec.com

info from tcpdump:

12:17:28.431208 IP (tos 0x0, ttl 64, id 57779, offset 0, flags [DF], proto UDP (17), length 97)
my.domainspec.com.33953 > ns1.entry.com.domain: [bad udp cksum 0xcb8a -> 0x6e04!] 63367+ A? my.domainspec.com.domainspec.com.domainspec.com. (69)`
`12:17:28.431718 IP (tos 0x0, ttl 64, id 61601, offset 0, flags [none], proto UDP (17), length 148)
    ns1.entry.com.domain > my.domainspec.com.33953: [udp sum ok] 63367 NXDomain* q: A? my.domainspec.com.domainspec.com.domainspec.com. 0/1/0 ns: domainspec.com. SOA ns1.entry.com. postmaster.domainspec.com. 2018012732 600 300 2592000 900 (120)

info from nsswitch.conf:

 grep "hosts" /etc/nsswitch.conf
 #hosts:     db files nisplus nis dns
 hosts:      files dns myhostname

info from /etc/hosts:

193.48.203.195  my.domainspec.com

info from /etc/resolv.conf:

 # Generated by NetworkManager
 search domainspec.com
 nameserver 8.8.8.8

Please note. I've used fake domain names and IPs for the example.

Could someone explain what the reason for the duplicate domain name in DNS query is? Any help is really appreciated.

Answer 1

You are describing pretty much normal, known and documented behaviour.

What it happens is when the resolver is not able to resolve a DNS name, it will try to resolve it appending all the domains in your search directive to the original query on turns (if it does not got a match in middle-process).

The process is a bit convoluted in itself, and several search domains can be combined due to the recursive nature of the process.

The way to somewhat minimize/avoid the domain expansion, when resolving DNS names, is in the search directive (or wherever you configure your search domains), or even at applicational level, terminating the DNS/domain names with a ".".

As in:

search domainspec.com. domain.com. example.com.

In addition, as an example, when doing a ping, domain search expansion can also be avoided in a case-by-case basis:

ping www.example.com.

or

ping www.cnn.com.

From man resolv.conf(5)

search Search list for host-name lookup.

          The search list is normally determined from the local domain
          name; by default, it contains only the local domain name.
          This may be changed by listing the desired domain search path
          following the search keyword with spaces or tabs separating
          the names.  Resolver queries having fewer than ndots dots
          (default is 1) in them will be attempted using each component
          of the search path in turn until a match is found.  For
          environments with multiple subdomains please read options
          ndots:n below to avoid man-in-the-middle attacks and
          unnecessary traffic for the root-dns-servers.  Note that this
          process may be slow and will generate a lot of network traffic
          if the servers for the listed domains are not local, and that
          queries will time out if no server is available for one of the
          domains.

          The search list is currently limited to six domains with a
          total of 256 characters.