oddity with trubuiltpambula.com.au
Matthew Richardson
matthew-l at itconsult.co.uk
Sun Apr 19 11:26:13 UTC 2020
The answer is that the .au registry has NS (delegation) records for the
webcity.com.au servers, but those servers return NS records for the
instanthosting.com.au servers. As you observed, they have the same IPs.
This can be shown using "dig +trace":-
>; <<>> DiG 9.11.17 <<>> +trace @a.root-servers.net trubuiltpambula.com.au
>; (1 server found)
>;; global options: +cmd
>. 518400 IN NS a.root-servers.net.
>. 518400 IN NS b.root-servers.net.
>. 518400 IN NS c.root-servers.net.
>. 518400 IN NS d.root-servers.net.
>. 518400 IN NS e.root-servers.net.
>. 518400 IN NS f.root-servers.net.
>. 518400 IN NS g.root-servers.net.
>. 518400 IN NS h.root-servers.net.
>. 518400 IN NS i.root-servers.net.
>. 518400 IN NS j.root-servers.net.
>. 518400 IN NS k.root-servers.net.
>. 518400 IN NS l.root-servers.net.
>. 518400 IN NS m.root-servers.net.
>. 518400 IN RRSIG NS 8 0 518400 20200502050000 20200419040000 48903 . g9774YgRJPvtetwzUTOSXxImvqUKt4jgg/QMu6GnlGcKJ8hbJKCrLddP 3uSFI3G/ZF57CUySqHIqIvQ8kA13Yg23LCWMOESQp0D6wqdd0xn6JbKg own+lH/PAjUw9ZHm0IolUrpbg8ig2pbLR7jv3XG9w9s4fV1GRjK+o26q /DXhswFWtQs4zV6sKg13rroWsPiU7frVcAg0wenhwjHvuFRAiMI6CXsv n4+PVLE69PtZ3cZjHYio7aUfFS7qmWvxjz7EAG1HLckRkyLms6PjDXBt 3ao9bERrU/PD/oZ8VwIZlPTNhrJOdte4fZSOLc1/cEQtnBLAN0xtmsOs do+8Bw==
>;; Received 1097 bytes from 198.41.0.4#53(a.root-servers.net) in 14 ms
>
>au. 172800 IN NS a.au.
>au. 172800 IN NS c.au.
>au. 172800 IN NS d.au.
>au. 172800 IN NS m.au.
>au. 172800 IN NS n.au.
>au. 172800 IN NS q.au.
>au. 172800 IN NS r.au.
>au. 172800 IN NS s.au.
>au. 172800 IN NS t.au.
>au. 86400 IN DS 18875 8 1 A6362D938429477C0F5E51E1F47A3516B39D281B
>au. 86400 IN DS 18875 8 2 FE773B2F77BB6A6DD31BA27EB19E8F64257937622CAB98F3926EE77F EA2BE79F
>au. 86400 IN RRSIG DS 8 1 86400 20200502050000 20200419040000 48903 . ozt+mtkvvSWbIMYHhRMG6r8PKUyJae+uvnod6us3H+9ogWt8XeAzuHDy mhxlkRaizuOnzqRIqzeGF4O79Ei/dCuj8zH5koAWMvL6UqtsWvHHNhE9 RaJ9TD1uF7FP9EtqGLpuXQe4q79appim3zUZahKszfxLLagvMR5JLOnI tlhByeQUw3Y6c6u5NiDCMxtGa4n9JORdR/k+lwjfoMLqMsyUMvdG9D6b 2kJb3P2COEVnIGcvlW9KqZKMeQj+EU/pL+DVCosE4dINfE3gzAsQVpIv uWE43+NlLYhUaY1Y/3suBuPQ7u5xW0Ujj5SApTTIoM4xlCRq7UgEr0/D TxgrTg==
>;; Received 962 bytes from 192.58.128.30#53(j.root-servers.net) in 14 ms
>
>trubuiltpambula.com.au. 900 IN NS ns3.webcity.com.au.
>trubuiltpambula.com.au. 900 IN NS ns2.webcity.com.au.
>trubuiltpambula.com.au. 900 IN NS ns1.webcity.com.au.
>md9i9voubqb55nj87e5v632qbmvr5iou.com.au. 900 IN NSEC3 1 1 1 D399EAAB MEFD6Q0ERABMQN2RAB50F1HH09I97LQJ NS SOA RRSIG DNSKEY NSEC3PARAM
>md9i9voubqb55nj87e5v632qbmvr5iou.com.au. 900 IN RRSIG NSEC3 8 3 900 20200510112409 20200419102409 14968 com.au. NaPYDJ8CRTqEZjbg0P0TixYilktxYIGAbaXtJfHDo6U1CKDVGM60xaxh ZR3r6HNm97DPDu6b2JBjDZorrii11Xnzh9BHLRQ9dUF8kTc4af2oXzlV Kdlro5syJi/KwSGhbt1RggHA4VkO3wKFtrfjDOmiLJIMQWHwkqBQ4NAm oQ4=
>vaqgmmki023nor48ihks806ma31inome.com.au. 900 IN NSEC3 1 1 1 D399EAAB VCD6O7SJS6DAC2HHRGC5KSV3IF445P3H NS DS RRSIG
>vaqgmmki023nor48ihks806ma31inome.com.au. 900 IN RRSIG NSEC3 8 3 900 20200509003832 20200417233832 14968 com.au. RHXFSR+P5JjZwnuqw4/qoBY2VNe6RCsuh46FHE5rBLwiroF92/bPd18w 8CbpolbV/RD24qmerrbULMIwqGUCMK3gtq3XiwVchovxwAimbxLgEyB8 PnziuUuMF2efxV1pW2Mz1quC5v18GiGWMoavAsXO+mdySr3q+PITMuq0 vKI=
>;; Received 660 bytes from 65.22.197.1#53(r.au) in 20 ms
>
>trubuiltpambula.com.au. 10800 IN A 203.39.65.64
>trubuiltpambula.com.au. 43200 IN NS ns1.instanthosting.com.au.
>trubuiltpambula.com.au. 43200 IN NS ns2.instanthosting.com.au.
>;; Received 118 bytes from 203.17.36.4#53(ns2.webcity.com.au) in 292 ms
Best wishes,
Matthew
------
>From: Karl Auer <kauer at biplane.com.au>
>To: "bind-users at lists.isc.org" <bind-users at lists.isc.org>
>Cc:
>Date: Sun, 19 Apr 2020 20:52:30 +1000
>Subject: oddity with trubuiltpambula.com.au
>In the "Nameservers" section of the DNS management interface at a
>hosting provider (webcity.com.au), we see three nameservers for the
>above domain:
>
>ns1.webcity.com.au (203.17.36.33)
>ns2.webcity.com.au (203.17.36.4)
>ns3.webcity.com.au (116.0.23.249)
>
>However, when we query the DNS for the nameservers for this domain, we
>get different answers:
>
>kauer at kt:~$ dig +short trubuiltpambula.com.au ns
>ns1.instanthosting.com.au.
>ns2.instanthosting.com.au.
>
>The two instanthosting nameservers returned have the same IP addresses
>as ns1.webcity.com.au and ns2.webcity.com.au. And for completeness we
>checked and there is also an instanthosting A record pointing to the
>same IP as ns3.webcity.com.au:
>
>kauer at kt:~$ dig +short ns3.instanthosting.com.au
>116.0.23.249
>
>We also get the two instanthosting nameserver names when we query any
>of those webcity nameservers directly. For example:
>
>kauer at kt:~$ dig +short trubuiltpambula.com.au ns @ns1.webcity.com.au
>ns1.instanthosting.com.au.
>ns2.instanthosting.com.au.
>
>A trace shows an additional lookup occurring between the website
>nameservers and the instanthosting nameservers being returned.
>
>kauer at kt:~$ dig +trace trubuiltpambula.com.au ns
>[...]
>trubuiltpambula.com.au. 900 IN NS ns1.webcity.com.au.
>trubuiltpambula.com.au. 900 IN NS ns2.webcity.com.au.
>trubuiltpambula.com.au. 900 IN NS ns3.webcity.com.au.
>[...]
>;; Received 660 bytes from 65.22.197.1#53(r.au) in 51 ms
>[...]
>trubuiltpambula.com.au. 43200 IN NS ns2.instanthosting.com.au.
>trubuiltpambula.com.au. 43200 IN NS ns1.instanthosting.com.au.
>;; Received 102 bytes from 203.17.36.4#53(ns2.webcity.com.au) in 30 ms
>
>Is there a good explanation for what's happening?
>
>Yours mystifiedly, K.
More information about the bind-users
mailing list