Share via

DNS resolution not working for some CNAMEs

Jim M 146 Reputation points
2020-07-15T06:35:55.47+00:00

I have several Windows 2016 domain controllers running DNS for my organisation. Each is configured with a forwarder to dns.google for non-local zones.
For the most part, they work fine. However we have seen a few cnames which dont resolve correctly. For example, if i look up this name directly to Google:

Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: apimgmths10cnqewnmgfvdeygrdexzehvcirfy7xt7yak3gfht.cloudapp.net
Address: 13.66.39.44
Aliases: www.nuget.org
nugetprodusnc.azure-api.net
apimgmttm3csrht7lvztprufrqlzasbgohlgs9virtv24ewckt.trafficmanager.net
nugetprodusnc-southcentralus-01.regional.azure-api.net

This is a valid response. If one of my clients looks this up via my DNS server rather than Google, it receives:

www.nuget.org

Server: [10.20.1.1]
Address: 10.20.1.1

Non-authoritative answer:
Name: www.nuget.org

Only the alias is returned. Not the associated A records or IP address. Why might this be?

Azure DNS
Azure DNS
An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
603 questions
0 comments
Accepted answer
  1. Jim M 146 Reputation points
    2020-07-15T23:15:31.777+00:00

    It turned out the cause was that someone in my organisation had mistakenly made a local zone for azure-api.net. With a local zone existing, our servers werent forwarding requests for machines in that zone - like www.nuget.org.

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sam Cogan 10,322 Reputation points MVP
    2020-07-15T06:54:15.263+00:00

    Firstly, if the record you are looking up is a CNAME it will always return the alias it is pointing to, not the IP. If you want to resolve the alias you would need to use a further nslookup on that.

    Secondly, if your DNS server is resolving records incorrectly then I would suspect that something is configured incorrectly on that specific DNS server. Without seeing it it is difficult to know, but I would suspect that either someone has created a zone on that server for google.com that is pointing to the wrong place, or that the forwarders are setup incorrectly to go to a different server. The other option is that the machine you are querying from has local host records setup with these details.

    1 person found this answer helpful.
    0 comments
  2. Jim M 146 Reputation points
    2020-07-15T06:59:42.907+00:00

    From my experience, using nslookup or Resolve-DnsName utilities always replies with all applicable aliases, A records, and IP addresses.
    This is further demonstrated if i change the DNS server for my client. When set to dns server 8.8.8.8, a ping to www.nuget.org is successful.
    When i set my client's DNS server to be one of my internal DNS server, the ping fails.

    ping www.nuget.org

    Ping request could not find host www.nuget.org. Please check the name and try again.

    0 comments