nslookup/dig differ from how a browser resolves a hostname

Question

At my site, we just moved an important service, and made the appropriate DNS changes internally and externally to make it work.

When you bring up the site in a browser, it works fine. (Works in Safari, Chrome, Opera, Firefox, on computers that have been on the network for a while and ones that have been off it for some time.)

That's good, to be sure. But when I type nslookup <hostname> or dig <hostname>, I get the old IP for the service. (If I put said IP in the browser, I get the former server for this service).

I'm perplexed. How is it that the browser resolving the new service but nslookup is not? [No, there is nothing about the site in /etc/hosts].

[Incidentally, is there any way to tell which IP a browser came up with for a site?]

score 4 · Answer 1 · answered Dec 11 '09 at 18:21

4

Another possibility is that the client machines on the network are going through an HTTP proxy server that picked up on the IP address change before they did.

answered Dec 11 '09 at 18:21

Sean Staats

810
7
6

1

Hmm... I think we do have a transparent proxy. – Clinton Blackmore Dec 11 '09 at 18:23
Nice catch Sean, this is the likely answer why HTTP works but raw DNS shows old info. – Dave Drager Dec 11 '09 at 18:33
Transparent proxies generally don't do the DNS lookup IIRC? Regular ones definitely do. – Tom Newton Dec 11 '09 at 21:42

score 3 · Answer 2 · answered Dec 14 '09 at 16:45

On Solaris and Linux there's getent (ex. 'getent hosts www.google.com') . This uses the system libraries to do the resolution rather than going directly to the name server (like nslookup). This is particularly useful when there are several naming services in play (local files, nis, dns) any of which could have an answer.

score 1 · Answer 3 · answered Dec 11 '09 at 18:10

My first thought was that you had an entry in /etc/hosts but it sounds like you checked there.

I would check the hostname at Squish to see what/who is involved in DNS resolution and the results that are currently being reported.

Don't forget that DNS can take a while to change over depending on nameservers involved and cache times. If you are only having issues locally there is probably some local DNS cache at play, and you need to reboot or let it time out. When it comes to DNS you have to think globally.

[ Squishywishywoo ]

score 1 · Answer 4 · answered Dec 22 '09 at 20:18

1

For your last question ("is there any way to tell which IP a browser came up with for a site"), I recommend, if you use Firefox, an extension like ShowIP or Site Information.

answered Dec 22 '09 at 20:18

bortzmeyer

3,941
1
21
24

nslookup/dig differ from how a browser resolves a hostname

4 Answers4