-2

nslookup is returning different answers for these queries:

nslookup my.example.com
nslookup http://my.example.com

I'm kind of confused because with http I would expect it to return NXDOMAIN error. Without http it returns a plain IP.

But, and this is the root of my confusion, the form nslookup http://my.example.com seems to be returning the CNAMEs and IPs that I'm actually expecting to see.

Here is the output of nslookup http://my.example.com

$ nslookup http://my.example.com
Server:     172.17.0.2
Address:    172.17.0.2#53

Non-authoritative answer:
http://my.example.com   canonical name = www.example.prod.us.onehippo.com.
www.example.prod.us.onehippo.com    canonical name = example.hosting.us.onehippo.com.
Name:   example.hosting.us.onehippo.com
Address: my ip

I'm confused. With http shouldn't nslookup return an error? If not, then why with http and without http the answers are different?

Perimosh
  • 2,304
  • 3
  • 20
  • 38
  • `nslookup` works with names, not URLs, so `nslookup http://my.domain.com` is meaningless and has no chance to produce any useful results (positive or negative). Also 1) your question is offtopic here as not related to programming and 2) you would get in general far better reply if you give the real names and not do some very bad obfuscation (do not use `domain.com` as an example, use `example.com`). – Patrick Mevzek Aug 06 '21 at 21:41
  • Also, default is doing an `A` query for DNS. Except that `A` record types work with hostnames and not domain names. An URL, with a scheme, can not be an hostname, hence you can't have an `A` record on it, which is why doing `nslookup` as you do can not provide meaningful records. Try with `dig` and change the record type. But again URL at the DNS stage makes no sense, so not sure what is your real question that made you come to this. – Patrick Mevzek Aug 06 '21 at 21:44
  • Hello Patrick. I bet there are thousands of questions not related to programming in StackOver flow. So, even if the nature of this space has been designed to be only-programming-questions, clearly the people is using in different way and for multiple purposes. Time for StackOverFlow to evolve maybe, it is my opinion though. – Perimosh Aug 08 '21 at 01:52
  • My first question (and based on your comments the only one that makes sense I think) was "With http shouldn't nslookup return an error?", and you didn't reply it. Before making this question I was 99% sure nsookup was only for domain names and not schemas, but even though wanted to make the question because I was expecting a NXDOMAIN error. And that answers your question about how I ended up like this. – Perimosh Aug 08 '21 at 01:53
  • Thanks for the advise about the bad obfuscated name. I will update the question. – Perimosh Aug 08 '21 at 01:54
  • " I bet there are thousands of questions not related to programming in StackOver flow. " That may be true but that does not make then your question on topic. – Patrick Mevzek Aug 08 '21 at 14:55
  • 1
    "Before making this question I was 99% sure nsookup was only for domain names and not schemas" I don't know what schemas mean there but in general the DNS maps names to other data, like IP addresses or other things. Note that I said "names" not hostnames which are a subset of all possible names. The DNS allows a name (domain name in their jargon) to be anything, so `http://my` is a name (string), and you can query the DNS for it. Not for `A` record because `A` is defined to map hostnames (not domain names) to IP addresses. Your case shows a CNAME and a wildcard basically, hence the behavior. – Patrick Mevzek Aug 08 '21 at 14:57

2 Answers2

1

http://my and my are different strings, so they can have different resolution behavior. http://my is not special and is passed through the DNS unchanged. In your case, it is probably matched by a wildcard, and my is not a wildcard.

Florian Weimer
  • 32,022
  • 3
  • 48
  • 92
1

Nslookup expects a domain name, not a url. A url contains a protocol (http), domain (my.example.com), a path (/something), and a query string (?a=1&b=2). So in your case, you'd need to only pass my.example.com to nslookup. Passing a url has undefined behavior in nslookup.

In any case, if you don't want to be bothered by this distinction, you can instead use https://www.nslookup.io, which can do a DNS lookup for a domain name, url and email address.

Ruurtjan Pul
  • 1,197
  • 1
  • 10
  • 21