difference in nslookup

[Kevin Darcy]

Armin Safarians wrote:

> Quick one here.
>
> In a split DNS environment that I run here, when I do an nslookup
> yahoo.com, my internal DNS server forward the query to the external ones
> and so on. Here once in a while this process fails to where snoop shows
> the query go from the client to the internal dns and then onto the
> external ones, the response however  coming back never gets to the
> internal dns from the external ones. I get a Error 2(Server Failed)
> message. This consistently only happens on one of the internal systems
> and not the other one.
>
> In troubleshooting here is what I have seen that is odd.
>
> Internal>     nslookup hostname.mydomain.com            OK
> Internl>              nslookup yahoo.com                        Fails.
>
> Internal>  nslookup
> Server externalhost.mydoamin.com
>
> Yahoo.com                       OK.
>
> So, the question is, what is a difference between doing an nslookup
> yahoo and letting the forwarders do  the forwarding, versus nslookup,
> setting the server to the external servers and then looking up yahoo.
> Hope this makes sense.

Well, are you *sure* that nslookup is reporting SERVFAIL on the same name you queried? One of nslookup's many quirks is that it sometimes misreports errors. I'm suspecting that nslookup is timing out on the original query, and then "search"ing using your default domain or your searchlist, e.g. looking up yahoo.com.example.com. It might be getting a SERVFAIL for that, and reporting it as a SERVFAIL for the original query. Turn on debugging to see if this is the case.

Or just use "dig" instead, so you don't have to deal with this nonsense...

                                                                                                                                - Kevin