What is the difference between ping and nslookup in name resolution?

Question

I am trying to understand the differences in the behavior of nslookup and ping when resolving hostnames to IP addresses. My confusion is summarized by this snippet from my terminal:

lllamnyp@lllamnyp:~/.ssh$ cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.221.131
nameserver 127.0.0.53

lllamnyp@lllamnyp:~/.ssh$ nslookup ingress-vpn.do.company.com
;; Got recursion not available from 192.168.221.131, trying next server
Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find ingress-vpn.do.company.com: NXDOMAIN

lllamnyp@lllamnyp:~/.ssh$ nslookup ingress-vpn.do.company.com 192.168.221.131
Server:     192.168.221.131
Address:    192.168.221.131#53

Name:   ingress-vpn.do.company.com
Address: 192.168.234.130

lllamnyp@lllamnyp:~/.ssh$ ping ingress-vpn.do.company.com
PING ingress-vpn.do.company.com (192.168.234.130) 56(84) bytes of data.
^C
--- ingress-vpn.do.company.com ping statistics ---

On request, here's the output for dig as well. It works:

lllamnyp@lllamnyp:~/.ssh$ dig ingress-vpn.do.company.com

; <<>> DiG 9.11.3-1ubuntu1.14-Ubuntu <<>> ingress-vpn.do.company.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55351
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: fcfdf62ef4bf6a33 (echoed)
;; QUESTION SECTION:
;ingress-vpn.do.company.com.        IN  A

;; ANSWER SECTION:
ingress-vpn.do.company.com. 30  IN  A   192.168.234.130

;; Query time: 161 msec
;; SERVER: 192.168.221.131#53(192.168.221.131)
;; WHEN: Wed Mar 10 12:10:14 MSK 2021
;; MSG SIZE  rcvd: 97

I have observed with strace that ping reads /etc/nsswitch.conf, while nslookup does not, but I'm not well-versed on their internals.

Here are my questions:

• If the problem is a non-recursive server, why does nslookup <HOSTNAME> fail, but nslookup <HOSTNAME> <DNS_SERVER_IP> does not?
• If the problem is a non-recursive server, how does ping successfully resolve the IP, when nslookup cannot?
• What has recursion got to do with this anyway, when 192.168.221.131 is IP address of the authoritative nameserver for do.company.com?
• Fundamentally, what's the difference between name resolution done by ping and by nslookup?

---

I am running Ubuntu 18.04 and the nameserver at 192.168.221.131 is CoreDNS 1.6.

---

Extra details:

Incredibly, while doing nslookup in one tab of the terminal and observing tcpdump in another, I see this:

Nslookup:

$ nslookup ingress-vpn.do.company.com
;; Got recursion not available from 192.168.221.131, trying next server
Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find ingress-vpn.do.company.com: NXDOMAIN

Tcpdump:

$ sudo tcpdump udp port 53 -i tun0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
12:24:12.419836 IP 10.1.1.2.57886 > 192.168.221.131.53: 12557+ A? ingress-vpn.do.company.com. (38)
12:24:12.432512 IP 192.168.221.131.53 > 10.1.1.2.57886: 12557*- 1/0/0 A 192.168.234.130 (74)

i.e nslookup receives the correct responses, but at that point has already given up.

Answer 1

Fundamentally, what's the difference between name resolution done by ping and by nslookup?

ping can employ various different ways of getting an IP address, (all listed in /etc/nsswitch.conf), while nslookup only asks the designated nameserver.