oddity with trubuiltpambula.com.au

Karl Auer kauer at biplane.com.au
Sun Apr 19 10:52:30 UTC 2020

In the "Nameservers" section of the DNS management interface at a
hosting provider (webcity.com.au), we see three nameservers for the
above domain:

ns1.webcity.com.au (
ns2.webcity.com.au (
ns3.webcity.com.au (

However, when we query the DNS for the nameservers for this domain, we
get different answers:

kauer at kt:~$ dig +short trubuiltpambula.com.au ns

The two instanthosting nameservers returned have the same IP addresses
as ns1.webcity.com.au and ns2.webcity.com.au. And for completeness we
checked and there is also an instanthosting A record pointing to the
same IP as ns3.webcity.com.au:

kauer at kt:~$ dig +short ns3.instanthosting.com.au

We also get the two instanthosting nameserver names when we query any
of those webcity nameservers directly. For example:

kauer at kt:~$ dig +short trubuiltpambula.com.au ns @ns1.webcity.com.au

A trace shows an additional lookup occurring between the website
nameservers and the instanthosting nameservers being returned.

kauer at kt:~$ dig +trace trubuiltpambula.com.au ns
trubuiltpambula.com.au. 900 IN NS ns1.webcity.com.au.
trubuiltpambula.com.au. 900 IN NS ns2.webcity.com.au.
trubuiltpambula.com.au. 900 IN NS ns3.webcity.com.au.
;; Received 660 bytes from in 51 ms
trubuiltpambula.com.au. 43200 IN NS ns2.instanthosting.com.au.
trubuiltpambula.com.au. 43200 IN NS ns1.instanthosting.com.au.
;; Received 102 bytes from in 30 ms

Is there a good explanation for what's happening?

Yours mystifiedly, K.

Karl Auer (kauer at biplane.com.au)

GPG fingerprint: 2561 E9EC D868 E73C 8AF1 49CF EE50 4B1D CCA1 5170
Old fingerprint: 8D08 9CAA 649A AFEF E862 062A 2E97 42D4 A2A0 616D

More information about the bind-users mailing list