1

When I run nslookup using our (it defaults our domain NS as the source of information) I get different results every time for known computers on our network.

Can some one explain if this is normal, why it is normal? Or if it needs to be resolved the next steps?

sammarcow
  • 245
  • 1
  • 3
  • 14
  • 1
    For example? Give at least two examples of consecutive calls. – mailq Aug 30 '11 at 18:33
  • I'm thinking you have stale records. Do you use DHCP to assign ip addresses to client machines? Do you have aging/scavenging enabled on the DNS server and the zones? Do you use RRAS and if so, do you assign the RRAS clients an ip address via DHCP? – joeqwerty Aug 30 '11 at 18:39
  • Or do you have a very short lease time and between consecutive calls hours passed? – mailq Aug 30 '11 at 18:54

1 Answers1

4

According to RFC1034 §5.3.3,

In addition to the names and addresses of the servers, the SLIST data structure can be sorted to use the best servers first, and to insure that all addresses of all servers are used in a round-robin manner

That is to say, if there are multiple resource records matching the record type of the query, most name servers will return them in a round-robin manner (the additional records may or may not be included in the answer section or displayed by the resolver). My guess would be that you have multiple records for the same domain, each with different content.

JCallicoat
  • 601
  • 5
  • 5