0

I am trying to update the DNS for one of my servers. The forward lookup works fine. i.e. dig www.mydomain.com.

However, the reverse dns lookup provides results of some other site/server. I noticed in the beginning there was an error with the configuration and fixed it, however the reverse lookup still provides the wrong answer.

For example, if I used:

dig -x 46.101.84.103

It doesn't resolve to my domain name. It just shows information relating to my webhosts server. However, if I do:

dig @localhost -x 46.101.84.103

It shows my correct domain name. I'm not sure if this means it works or not. Could it be that when not specifying the localhost server it is querying the default one (8.8.8.8) and return the old cached version? Or does that not matter?

1 Answer 1

2

It's a stupid question, but... Are you even in control of the settings of your reverse DNS? You can only set the reverse DNS at your ISP/Webhost. So, if you rent the IP 46.101.84.103, it is the DNS server at Digital Ocean Inc, that will reply to these reverse queries. Your DNS, that resolves whatever.example.com to 46.101.84.103 cannot do the reverse DNS.

You might have configured a DNS that does this (evidently that's possible and that might be your localhost), but the Internet will never ask this server, because that IP range belongs to your ISP/webhost.

That's because some DNS servers are "authorative" for certain resources. If you own a domain name, you can set the "authoritative" DNS servers for that doman at your registrar (or use the registrars DNS). For example, if I do:

$ dig tude.lu

; <<>> DiG 9.10.3-P4-Ubuntu <<>> tude.lu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53410
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tude.lu.           IN  A

;; ANSWER SECTION:
tude.lu.        300 IN  A   85.93.203.237

;; AUTHORITY SECTION:
tude.lu.        43200   IN  NS  dns2.jawtheshark.net.
tude.lu.        43200   IN  NS  dns1.jawtheshark.net.

;; ADDITIONAL SECTION:
dns1.jawtheshark.net.   411 IN  A   149.154.152.102
dns2.jawtheshark.net.   579 IN  A   162.252.172.158

;; Query time: 133 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Mon Aug 08 20:54:46 CEST 2016
;; MSG SIZE  rcvd: 137

You notice the "authority section"? Well, in a DNS query, that means that anything regarding tude.lu, must be asked from one of those two servers (dns1.jawtheshark.net and dns2.jawtheshark.net). Your local DNS may cache the results, but ultimately, only those two servers can be trusted to give correct results. They are "authoritative".

That's for domain names (basically, "normal" DNS queries). For IP ranges, the same exists. The thing is: an IP range is not linked to a domain at all. The IP range is another resource all together. So, let's take the IP you gave. Who is authoritative?

$ dig -x 46.101.84.103

; <<>> DiG 9.10.3-P4-Ubuntu <<>> -x 46.101.84.103
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 65419
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;103.84.101.46.in-addr.arpa.    IN  PTR

;; AUTHORITY SECTION:
84.101.46.in-addr.arpa. 1466    IN  SOA ns1.digitalocean.com. hostmaster.84.101.46.in-addr.arpa. 1470460984 10800 3600 604800 1800

;; Query time: 1 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Mon Aug 08 20:53:02 CEST 2016
;; MSG SIZE  rcvd: 122

Again, the information we want is in the authority section. It seems to be the primary (ns1) nameserver of digitalocean.com. If you do not have access to the configuration of that DNS server, you will not be able to change the reverse IP lookup. Now, that doesn't mean you can't set it, because many hosters allow you to do that in their management interfaces. Alas, I can't help you there and you need to ask them, go read their FAQ, or explore the interface they have given you.

What I assume, but of course I may be wrong, is that you configured a DNS server on your localhost that is configured to reply the PTR records (reverse lookup), but the Internet at large will never query that machine, because... it's not authoritative. So locally, it obviously works: your server "thinks" it's authoritative, but it's not.

Of course, I might be totally mistaken with my assumption.

Hope the reply is not all that confusing. DNS requires a quite deep understanding and the "authority" concept is very important.

1
  • Thank you! I just checked with digitalocean.com and you can infact set the reverse dns setting on their control panel. I had gotten very confused about all this but your explanation is perfect :)
    – Patchesoft
    Aug 8, 2016 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .