Why Can't I get an authoritative answer from a DNS server.

windbadboy · 04-23-2011, 08:35 AM

When I type 'nslookup some site',the result I always get is a non-authoritative answer.
How can I get an authoritative answer?

winning · 04-23-2011, 09:06 AM

Hello. I believe that you receive a non-authoritative answer because, by default, nslookup asks your nameserver to recurse in order to resolve your query and because your nameserver is not an authority for the name you are asking it about. You can get an authoritative answer by querying the authoritative nameserver for the domain you are interested in. Finding the authoritative nameserver (through nslookup alone) can be tricky, I think (I've had some interesting experiences in this sense with www.redhat.com).

winning · 04-23-2011, 09:20 AM

Here is an example for www.linuxquestions.org:

Code:

> server 8.8.8.8
Default server: 8.8.8.8
Address: 8.8.8.8#53
> www.linuxquestions.org
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	www.linuxquestions.org
Address: 75.126.162.205
> set querytype=soa
> www.linuxquestions.org
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
*** Can't find www.linuxquestions.org: No answer

Authoritative answers can be found from:
linuxquestions.org
	origin = ns1.mydyndns.org
	mail addr = zone-admin.dyndns.com
	serial = 2008022056
	refresh = 10800
	retry = 1800
	expire = 604800
	minimum = 1800
> lserver ns1.mydyndns.org
Default server: ns1.mydyndns.org
Address: 204.13.248.76#53
Default server: ns1.mydyndns.org
Address: 2600:2001::76#53
> set querytype=a
> www.linuxquestions.org
Server:		ns1.mydyndns.org
Address:	204.13.248.76#53

Name:	www.linuxquestions.org
Address: 75.126.162.205

winning · 04-23-2011, 09:27 AM

Here is another example, this time for www.redhat.com:

Code:

> server 8.8.8.8
Default server: 8.8.8.8
Address: 8.8.8.8#53
> www.redhat.com
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
www.redhat.com	canonical name = www.redhat.com.edgekey.net.
www.redhat.com.edgekey.net	canonical name = www.redhat.com.edgekey.net.globalredir.akadns.net.
www.redhat.com.edgekey.net.globalredir.akadns.net	canonical name = e86.b.akamaiedge.net.
Name:	e86.b.akamaiedge.net
Address: 95.100.64.112
> set querytype=soa
> www.redhat.com
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
www.redhat.com	canonical name = www.redhat.com.edgekey.net.
www.redhat.com.edgekey.net	canonical name = www.redhat.com.edgekey.net.globalredir.akadns.net.
www.redhat.com.edgekey.net.globalredir.akadns.net	canonical name = e86.b.akamaiedge.net.

Authoritative answers can be found from:
b.akamaiedge.net
	origin = n0b.akamaiedge.net
	mail addr = hostmaster.akamai.com
	serial = 1303568497
	refresh = 1000
	retry = 1000
	expire = 1000
	minimum = 1800
> lserver n0b.akamaiedge.net
Default server: n0b.akamaiedge.net
Address: 213.198.95.144#53
> set querytype=a
> e86.b.akamaiedge.net
Server:		n0b.akamaiedge.net
Address:	213.198.95.144#53

Name:	e86.b.akamaiedge.net
Address: 95.100.64.112

I followed this up by:

Code:

$ nc 95.100.64.112 80
GET / HTTP/1.1
Host: www.redhat.com
User-Agent: winning
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
	<title>redhat.com | The World's Open Source Leader</title>

.. so e86.b.akamaiedge.net at least appears to be the canonical name for www.redhat.com, which I was initially interested in.