host resolving to an IP not in the zone

[josephc]

It was cached after the first lookup. If you do two or more quries against
most servers, then you will start seeing non-authoritive returns.

But as I was saying, it had to get that address from somewhere, pesumable
the authrative server. But that server has never had that IP address in
its zone records for any reason at all.

joe

#############

kevin wrote:

The bogus answer was non-authoritative, meaning that it got cached from
somewhere. You could set "host-statistics yes" and next time it happens,
dump the cache. Then you'll be able to tell exactly where the answer came
from. Be aware, however, that host-statistics will increase your memory
usage...


-Kevin

josephc wrote:

> Ok, this is just weird:
>
> > nslookup -q=a health.healthcommunities.com dns.etards.net
> Server:  h0000c5785fb6.ne.mediaone.net
> Address:  66.31.249.69
>
> Non-authoritative answer:
> Name:    health.healthcommunities.com
> Address:  192.168.1.10
>
> But a lookup against the master server:
>
> > nslookup -q=a health.healthcommunities.com
health.healthcommunities.com
> Server:  health.healthcommunities.com
> Address:  63.127.8.210
>
> Name:    health.healthcommunities.com
> Address:  63.127.8.210
>
> dns.etards.net/h0000c5785fb6.ne.mediaone.net is not in anyway related to
> healthcommunities.com, it just happens to be another DNS server I
manage.
>
> The zone for healthcommunities.com contains absolutly no reference to
> 192.168.1.10. However, that IP is the internal address for
> health.healthcommunities.com in its home network. But again, that IP
> address is not stated anywhere in any DNS records and it never, ever has
> :)
>
> So does anyone know where it could be coming from? It does not appear to
> be cached info, and so far it only happens to queries against that DNS
> server, but I am worried that it could be happening elsewhere and I just
> don't know it.
>
> thanks
>
> -joe