3

I used the host command on Ubuntu 12.04 LTS to check my DNS server:

host -a www.amazon.com

showing this:

Trying "www.amazon.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22892
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.amazon.com.            IN  ANY

;; ANSWER SECTION:
www.amazon.com.     60  IN  SOA ns-942.amazon.com. root.amazon.com.        1405660589 3600 900 7776000 60
www.amazon.com.     7   IN  A   72.21.194.212
www.amazon.com.     412 IN  NS  ns-942.amazon.com.

Received 110 bytes from 127.0.0.1#53 in 176 ms

Why Received form 127.0.0.1?

I've tried different websites, and moved to different locations trying this command. The DNS server shown is always the same: 127.0.0.1. Why?

0

1 Answer 1

4

The IP address 127.0.0.1 means localhost, i.e. it refers to your computer. The DNS response is coming from your computer.

The host program, like all other programs on the system, knows which DNS server to query by looking in the file /etc/resolv.conf.

The reason your computer is sending the DNS response is that it is running a DNS cache. The DNS cache software remembers requests, so that if you access the same site multiple times in quick succession (for example, to display a web page with embedded images, Javascript, frames, etc., or display several pages from the same site), only the first request needs to wait for a reply from a distant server, and subsequent requests get a very quick reply from the local machine.

Ubuntu runs dnsmasq as a DNS cache by default. Dnsmasq itself queries a DNS server provided by your ISP; this configuration is normally done dynamically (through resolvconf: the DNS server is added to the configuration when the corresponding network interface goes up and removed when the interface goes down. Available DNS servers for Dnsmasq are recorded in /etc/resolvconf/run/interface/*.

Note that I provide file names for curiosity purposes only. There are very few circumstances where you would want to edit them.

5
  • such a good answer!
    – BluePython
    Mar 20, 2016 at 20:57
  • I thought the DNS servers are recorded in etc/resolvconf/resolv.conf.d/
    – BluePython
    Mar 20, 2016 at 21:00
  • @BluePython The servers in that directory are the ones used by programs running on this machine. Normally there's only 127.0.0.1. The DNS servers from the that your machine queries are calculated at runtime based on the available network connections, and they're recorded under /etc/resolvconf/run/interface`. Dnsmasq is the only program that uses this information: applications contact dnsmasq and dnsmasq contacts the external DNS servers. Mar 20, 2016 at 21:08
  • sorry not sure I understood. The info at etc/resolvconf/resolv.conf.d/ is used to calculate /etc/resolvconf/run/interface/ ?
    – BluePython
    Mar 21, 2016 at 3:19
  • 1
    @BluePython No. You need to distinguish two sets of DNS servers: the servers that applications query (recorded in /etc/resolvconf/resolv.conf.d), and the servers that the machine queries (recorded in /etc/resolvconf/run/interface). On a modern Ubuntu under the default configuration, applications query the locally-running dnsmasq (they know because /etc/resolv.conf is built from /etc/resolvconf/resolv.conf.d), and that dnsmasq instance queries the external servers (from information in /etc/resolvconf/run/interface). Mar 21, 2016 at 12:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .