I don't understand DNS

[-]

Ferretau@reddit

It may be the link provider is required to filter dns traffic to comply with country specific laws, or the provider is using it to redirect traffic for their own purposes. I have seen where this has caused problems in the past.

Reply

[-]

colin8651@reddit

It’s always DNS

Reply

[-]

Deadmeat3344@reddit

its never DNS

Reply

[-]

Phate1989@reddit

WTF is an international link

Reply

[-]

gandraw@reddit

Well, if the request times out, it's not because of a missing DNS entry (otherwise there'd be an NXDOMAIN response). C:\temp>nslookup sdfgsdfgsdfgsdfgds.com Server: UnKnown Address: 10.67.0.1 *** UnKnown can't find sdfgsdfgsdfgsdfgds.com: Non-existent domain This rather seems like a firewall issue with port 53. Try doing a dns lookup from an unblocked network (guest wifi, WWAN, your home computer).

Reply

[-]

Moist-Inspector@reddit (OP)

>This rather seems like a firewall issue with port 53. Try doing a dns lookup from an unblocked network (guest wifi, WWAN, your home computer). I kind of confirmed that the problem lies in our main international upstream firewall. Because it worked after the traffic is switched to a backup link. But funny thing happened as in the updated original post.

Reply

[-]

ProfessorChaos112@reddit

It's not funny, it's normal TTL/cache behaviour. Is TCP and UDP 53 open on the fw? To which dst hosts is it allowed?

Reply

[-]

Moist-Inspector@reddit (OP)

>Is TCP and UDP 53 open on the fw The problem wasn't in our firewall, but the main upstream's firewall. I crossed that possibility because when i checked from those port checker available on the internet, port 53 udp showed something like "open or filtered" so i it should be open i guessed. Turned out when we switched to another upstream, it worked as normal

Reply

[-]

rhavenn@reddit

You probably had local response caches which is why it took a bit to start failing again.

Reply

[-]

Upper-Bath-86@reddit

Probably this.

Reply

[-]

Officialdrazel@reddit

Agree, likely blocked dns port 53 udp outgoing to anything other then those two dns servers

Reply

[-]

alm-nl@reddit

Don't forget about port 53 TCP, which is used when making larger queries.

Reply

[-]

sitesurfer253@reddit

I'm curious, what makes determines the size of a DNS query? The size of the IP table it returns?

Reply

[-]

Capodomini@reddit

DNS should switch to TCP when the response is over 512 bytes. DNSSEC data can cause this, as well as large AAAA responses.

Reply

[-]

osilo@reddit

Came to the comments expecting you to get laughed at about basic protocol understanding. BTW, Im sure AI will replace us all. Turns out the majority of people here can't read documentation. This shit is IETF.

Reply

[-]

Moist-Inspector@reddit (OP)

Alright mr dns einstein calm down.

Reply

[-]

michaelpaoli@reddit

>wtf is dig Like the most commonly used and generally accepted tool for getting DNS information and doing most DNS troubleshooting and the like. So, start learning about DNS and dig - there's a lot to it.

Reply

[-]

madnessofsuttercane@reddit

Try nslookup

Reply

[-]

Kamamura_CZ@reddit

NEVER use nslookup!!! It's strongly advised against by the ISC. The reason is that it gives confusing answers, and you often don't know where the information it returns comes from. Dig displays all the contents of the DNS packet, including flags, sections, etc.

Reply

[-]

MrNiceBalls@reddit

The problem is that while `dig` uses the OS resolver libraries, `nslookup` uses its own ones. So while it will give you the answer, it can be different from the answer your applications get when using the OS resolver.

Reply

[-]

Kamamura_CZ@reddit

That's precisely why you should NEVER use nslookup - it teaches you to treat DNS as a blackbox by obscuring the internals. If you are serious about debugging DNS problems, you should always care about where the information comes from, with which flags, and if it fails, what is the return code. Nslookup does not provide this information by default. Dig also has a lot of functionality nslookup simply lacks - tracing the whole delegation hierarchy, sigchase, dnssec-related debugging (for those, "drill" provides even more), etc.

Reply

[-]

SK-Incognito@reddit

Relax dude

Reply

[-]

Kamamura_CZ@reddit

I am providing accurate information.

Reply

[-]

osilo@reddit

If it helps, you're exact reasoning is why I prefer nslookup.

Reply

[-]

osilo@reddit

You're the guy that refuses to use a screwdriver for two screws when the drill battery is flat. Keep building obstacles, feels good to clear 'em.

Reply

[-]

bilingual-german@reddit

OP: not only check firewalls, also check your resolv.conf

Reply

[-]

telestoat2@reddit

Dig, nslookup, and host are all just as good as each other. I use dig and host more than nslookup but really the best tool is what you have on the system you need to troubleshoot on.

Reply

[-]

Kamamura_CZ@reddit

They are not "just as good as each other" for the reason explained above.

Reply

[-]

telestoat2@reddit

Do what works for you, but don't tell other people they should "NEVER" use a tool that works for them. All 3 of them have been useful to me at various times. nslookup I usually end up using on Windows systems. It also has the advantage of working as a shell though, instead of just taking arguments, you can pipe a series of commands to it. They're good in different situations.

Reply

[-]

Kamamura_CZ@reddit

You can pipe outputs of any command, that's a nonsensical argument. I stand by my recommendation as I have provided valid argument for why dig is far superior than host or nslookup (which is generally obsolete and deprecated). Any person with a modicum of experience with DNS debugging would agree with me - since you are clearly not such a person, your opinion is not all that relevant. Stick to your obsolete ways, I don't care.

Reply

[-]

telestoat2@reddit

Have you ever used nsupdate? I found knowing about nslookup helpful when I had to use nsupdate.

Reply

[-]

madnessofsuttercane@reddit

I think you're being a bit hyperbolic. Nslookup is fine when I'm interested in querying specific dns servers.

Reply

[-]

joshtheadmin@reddit

I'd prefer a coworker who is militant about preferring dig to nslookup over the countless coworkers I've had who don't understand what DNS is at all.

Reply

[-]

deltashmelta@reddit

The three major food groups: Doritos, Nachos, and Sriracha.

Reply

[-]

SK-Incognito@reddit

I'd rather a coworker that isn't Dwight from The Office.

Reply

[-]

madnessofsuttercane@reddit

There are hills to die on, but this doesn't even rise to the level of a dropped kerb

Reply

[-]

SK-Incognito@reddit

Lol I was thinking the same thing. Chill bro, nslookup is fine

Reply

[-]

Frothyleet@reddit

You can use dig via WSL, but Resolve-DNSname is a perfectly functional tool in its own right.

Reply

[-]

tehgent@reddit

Turn on the windows developer mode and install Ubuntu from the store. Once setup and in, Use dig there to look up your dns. Though I don't recall if dig is built in or third party. If it's not there you can run 'sudo apt get dig'

Reply

[-]

TraceLines@reddit

https://youtu.be/4ZtFk2dtqv0?si=bv5vE4KPObyG5_vw

Reply

[-]

CreeperFace00@reddit

Came here for this comment, though it should definitely be the top reply.

Reply

[-]

bingblangblong@reddit

https://media4.giphy.com/media/v1.Y2lkPTc5MGI3NjExajdldXo2MnVpMTN0NDY5eG40cndxZXA1cHg3c3lxNHFlM3UzZzdzbiZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/xYGudRU28WZcQ/giphy.gif

Reply

[-]

Vangoon79@reddit

99.9% of people who claim they understand don't actually understand DNS. Its quite amazing to me how people get so far in their IT careers and still not have a clue about basic fundamental stuff like DNS.

Reply

[-]

hurkwurk@reddit

Its all about knowing just enough to be dangerous.

Reply

[-]

alm-nl@reddit

If you want to know more about DNS, search for the book "DNS and BIND" from O'Reilly.

Reply

[-]

ImmediateLobster1@reddit

Agreed. That book is a bit Linux/Unix centric, but it covers all the key concepts that an admin should know about DNS.

Reply

[-]

alm-nl@reddit

On the internet (public use) I guess most use Linux or BSD. Windows is, I think, less likely to be used on the Internet as a DNS server.

Reply

[-]

spehktre@reddit

Someone link the cat video

Reply

[-]

redwiresystems@reddit

/u/TraceLines beat us all to it: https://reddit.com/r/sysadmin/comments/1avea9f/i_dont_understand_dns/kra2923/

Reply

[-]

iamamisicmaker473737@reddit

find out who last made changes sounds like internet is down

Reply

[-]

spin81@reddit

Last I heard 1.1.1.1 and 8.8.8.8 were part of the internet

Reply

[-]

DULUXR1R2L1L2@reddit

>the dns thingy would still worked for like an hour or so, That's probably the DNS record's ttl

Reply

[-]

LRS_David@reddit

Nobody does. I'll show myself out.

Reply

[-]

ruyrybeyro@reddit

If you dont understand DNS, how do you know you are not blocking it? A common and recurring mistake I have seen over the years is network admins blocking 53/TCP...

Reply

[-]

v0lkeres@reddit

its like the phonebook on your mobile. you dial your girlfriend, your phone dials 012345-66666

Reply

[-]

xendr0me@reddit

WOAH WOAH WOAH buddy, they/them or I'm running to HR!

Reply

[-]

Moist-Inspector@reddit (OP)

I laughed too. People probably downvoted you because your joke almost choked them to death.

Reply

[-]

xendr0me@reddit

Some people just can't understand a joke. (And it was in reference to a post here a few days about about someone getting written up for not using pro-nouns with a new person who started at their office, they used the word "bro")

Reply

[-]

Lordcorvin1@reddit

I think I missed the post. Can you link me?

Reply

[-]

SK-Incognito@reddit

Ignore the downvotes, I laughed.

Reply

[-]

ChiSox1906@reddit

DNS is tough. It's so weird at times it's literally a meme on this thread and in the community as a whole. Don't be too hard on yourself :)

Reply

[-]

mcshanksshanks@reddit

Any everyone loves to blame DNS but it’s almost always the Firewall.

Reply

[-]

Moist-Inspector@reddit (OP)

Yea it's the firewall this time.

Reply

[-]

what-the-hack@reddit

You don't understand or don't remember that internet traffic is a highway. You got an address, and bunch of loading/unloading spots and a gate guard. Someone told the guard to fck everyone off that's not coming in from a specific place. Here you are telling your other guy that they can definitely park up in that spot meanwhile the gate security is chasing them off with guns.

Reply

[-]

Glass_wizard@reddit

Dig is the Linux equivalent to Windows nslookup. They are both command line tools that allow you to check DNS settings.

Reply

[-]

BOOZy1@reddit

DNS isn't that hard but many explanations go into too much detail about the hierarchy of domains, sub-domains and top-level domains. Very simplified you have three base structures: 1 - recursive (or forwarders) 2 - authoritative 3 - root  1 - recursive are [1.1.1.1](https://1.1.1.1), [8.8.8.8](https://8.8.8.8), etc., you ISP or your local router. These can use other recursive DNS servers to help speed things up, those are called forwarders in that case 2 - authoritative are the servers who are the 'boss' of a certain domain 3 - root servers are the base that makes everything work  If you ask a recursive DNS server about a domain the following will happen: \- cache is searched first to save time \- if it's not in the cache it'll be asked of the first forwarder \- if there's no (working) forwarder it will be asked from the root servers \- the root servers don't give the DNS info, they points towards the authoritative servers \- the authoritative server will be asked and gives you answer (if it's confirmed to be authoritative for the DNS entry/domain in question)  To speculate on your problem, if the authoritative servers are having trouble either the root or recursive DNS servers might not be able to find or query them successfully. Additionally, some DNS query types might be rate limited to prevent certain attacks.

Reply

[-]

OlivTheFrog@reddit

Here a sample to illustrate Internal DNS is SOA (Start of authority : the boss) of the DNS zone MyDomain.local A client query its DNS server for [www.awesomedomain.com](https://www.awesomedomain.com) The Internal DNS is not the SOA of this zone, and not a Name server for this zone, then 2 cases : * The internal DNS server hasn't fowarder set then it query the Internet root servers. This is a iterative query. Here the process * "Hey Root server, Give me the SOA or a name server for the zone com" * the root server answer and then "Hey Com dns server, give me the SOA or a name server for [myawesomedomain.com](https://myawesomedomain.com)" * the com dns server answer and then "hey [awesomedomain.com](https://awesomedomain.com), give me the record for [www.myawesomedomain.com](https://www.myawersomedomain.com)" * The internal DNS server has forwarder (s). * "Hey forwarder, give me the record for [www.awesomedomain.com](https://www.awesomedomain.com)". The forwarder do iterative queries and answer to the internal DNS. * if the first forwarder is out, a time out occurs. Then the interanl DNS server query the second forwarder ... until a global forwarder timeout, then it uses the root DNS server. Set 2 or 3 forwarder max is ofter enough cause the global timeout is reach after this.  * At this step the internal DNS server could answer to its client (if no timeout of course). This is for the first client that query the Internal DNS server. For the next one, the Internal DNS use cache to faster answer. Note that the client has also a local DNS cache. Forwarders vs DNS Root servers : * Forwarder : Only one query (recursive query. note that client do recursive query too). Expose your Internal DNS server to the Internet unless the forwarder is on a DMZ (in thsi case only the forwarder in the DMZ is exposed to the Internet) * DNS root servers : mutiple queries (iterative query). Expose your Internal DNS to the Internet. Now if we take this case : 2 domains on your network Domain1.local and Domain2.local. Your need is that the 2 domains are resolved. The dns for the domain1.local has as a conditional forwarder the IP address of the DNS server for the zone Domain2.local. and vice versa, and has another dns, located in a DMZ as a forwarder. The dons for the zone domain2.local has alos the Dns located in the DMZ in the DMZ. By this, the network flows to the internet are restricted to the DNS located in the DMZ and your internal DNS are not exposed. For your users/computers/App they can resolve name the 2 internal domain, then the goal is reached.  Nota 1 : the timeout for forwarders and the global timeout for all forwarders can be configured (the way depending your DNS server). Often it's 3 seconds for the first one and 12 seconds for the last one. * Query 1st forwarder during 3 seconds ==> timeout * Lets pass 1 second * query the 2nd fowarder during 3 seconds ==> timeout * Lets pass 2 second * query the 3rd forwarder during 3 seconds ==> timeout * The global forwarder timeout is reached, the query fails. Nota 2 : the local cache for the DNS server is foter 15 or 30 min. Thge local cache for the client (Internet browser or app) is fotert 15 or 30 min too. Hope this is useful. regards

Reply

[-]

alastorid@reddit

DNS is basically the internet's "hello world" working on UDP port 53. Remember, a packet can be reshaped into anything, so you might not get a true response from what you thought it to be.

Reply

[-]

Kamamura_CZ@reddit

Don't look for quick solutions of a particular problem (you will never learn anything in depth), try to understand the concept and the implementation as a whole. There are tons of really spoon-fed tutorials. DNS nowadays has the problem of becoming really, really complex and obscure with the introduction of DNSSEC. That's where the hard to debug problems start.

Reply

[-]

rUnThEoN@reddit

For every problem, have a working configuration, compare it to the broken and thereby splitting the problem in half. If you have no dns problem with internet over the smartphone stuff gets blocked along the way. Then icmp echo and trqceroute is your friend. DNS itself is simple, give it a name to eat, it gives you an IP/response back. Its a hierarchie thing, so it has master servers, things in between and your own domain. Imagine it as kingdom, citys and your house/domain.

Reply

[-]

Consistent_Chip_3281@reddit

You will totally get what you need to get if you want, keep asking threads like this eventually some savant will be like “oh ya blah blah” and then we will all know

Reply to Post

72 Comments