Windows Forum

Ask something
Discussion Locked

what is the name resolution source?

0 helpful
5 replies

by greybeard770 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When I type
ping www.techrepublic.com
it resolves www.techrepublic.com to 64.236.16.52 and does the ping. That name was resolved to that IP address by a DNS server somewhere. Is there any way to find the source of that information? Getting just the IP address or the information source would be great. Further providing that it was resolved by C:\windows\hosts or a WINS server or DNS would be even better.

For example, I would run the theoretical WHOSAYS program and the dialog would go like this:

C:>WHOSAYS www.tecrepublic.com
DNS on 10.20.30.40 resolves www.tecrepublic.com to 64.236.16.52
C:>WHOSAYS mail.techrepublic.com
C:\windows\hosts resolves mail.tecrepublic.com to 12.43.21.4
C:>

This theoretical WHOSAYS utility would be very helpful finding out of date information in a local HOSTS file. I can use NSLOOKUP and enter the IP address of where I want to look for the information, but that is not what I want. The need is to know the source of the wrong information.

5 replies

by acattr

simply put, don't use hosts files. NSLOOKUP "set q=ns"

if you ping a name for example "server1" and you get back "pinging server1.domain.com" then it was resolved over DNS, if you get "Pinging server1", then it was via WINS or Broadcast.

by greybeard770

I agree, wwwacny. Using a hosts file tends to not be the best idea in general. But 6 years ago, hosts was much faster than waiting for DNS to fail and working down to WINS to find an Exchange server. So some old computers have the old hosts file.
One thing I'm working on here relates to VPN clients. We have public and private DNS servers for domain.com. They don't communicate between public and private by design. Some VPN clients seem to be using different DNS servers but I'm having trouble clearly defining that.
I am also trying to determine if the information comes from the SOA or was cached somewhere.

by cg it

Verisign's WhoIS lookup will provide you with what name servers and registry service is being used for a particular domain name.

you can get a commercial WhoIs utility program [I use one from G-Lock Software that has not only a WhoIs utility buta port scan, Registy cleaner, network monitor,traceroute, email analizer utilities. Nifty program]

by cg it

note: If you are getting a wrong name to IP address resolution, the problem may just be a glue record for the A record your registrar uses for your domain to IP address in their name servers. Glue records are very useful to static IP addresses and are in reality a registered IP address to Domain name.

For an understanding of glue records see http://support.dyndns.org/whitepapers/glue.php

This little white paper is pretty good at explaining glue records.

by cg it

another note: If you don't have a static ISP assigned IP address, rather have a dynamic IP address and are using your Registry name servers or a 3rd party name server to resolve IP to Name, a client program that updates the name server with the correct dymanically IP address is required to ensure that the correct IP address is resolved to the domain name. The link above to Dyndns.org has a couple of other papers and a FAQ section that explains client programs for updating dynamic IP address assignment with name servers. Also note: a change in IP address from your ISP might take up to 3 to 4 days to propagate throughout the internet as Verisign's TTL for WhoIS is about 72 hours.

This discussion is closed to new replies.