what's the name?

[Kevin Darcy]

Bovine Unit #243 wrote:

> I'm new at DNS, and have a question about what DNS should return for a
> query. Say I have a DNS primary machine named quack.duck.org with IP
> of 192.168.123.4, and that I'm logged on on the said machine. Using
> nslookup, there are 4 outputs:
>
> Server: x1
> Address: x2
>
> Name: x3
> Address: x4

x1 = name of server answering query (if it can be determined)x2 = address
of server answering query
x3 = name associated with query (for an address-to-name lookup, this is
the result of the query rather than the query itself)
x4 = address associated with query (for a name-to-address lookup, this is
the result of the query rather than the query itself)

Sometimes nslookup will also append an "Aliases:" line, which will
contain the alias (or chain of aliases) discovered while translating the
name into an address.

For other types of queries besides just the basic "A" (name-to-address)
or "PTR" (address-to-name), there are various output formats.

> What I'd like to know is what should I get if I query "localhost"? For
> result "x1", should I get "localhost," "localhost,duck.org," or
> "quack.duck.org"? And for output "x2" should it be "127.0.0.1" or
> "192.168.123.4"? And what of outputs x3 and x4?

The values of x1 and x2 depend on how your resolver is configured (check
/etc/resolv.conf if you're on a Unix-like box or somewhere in the Control
Panel/registry maze if you're on Wintel) and/or whether you have switched
servers using nslookup's "server" or "lserver" command or given it a
command-line argument to use a different server than the resolver
default. The values of x3 and x4 depend on what "localhost" entries, if
any, happen to be in the DNS database you are querying, what your default
domain is, whether "defnames" is on or off, what your searchlist is,
etc., etc.. nslookup follows a particular order in trying to resolve
whatever name you give it. There's no reason for it to return
"quack.duck.org" for a "localhost" query, unless the first "localhost" it
finds happens to be an alias for "quack.duck.org" (in which case there
will be an "Aliases:" line in the output, as described above).

> Same question, but with "127.0.0.1" "quack" "quck.duck.org" as the
> arguments.

Again, it all depends on what the DNS database contains, and what your
nslookup settings/arguments are.

Just FYI, "dig" (part of the BIND distribution) is generally considered a
better DNS debugging tool than nslookup.


- Kevin