up vote 1 down vote favorite
share [g+] share [fb]

Somehow, I've been having a chronic issue where my computer will get an invalid DNS lookup in its cache for either of the two Exchange servers I use from Mail.app. My workplace runs one of the Exchange servers and I run the other (they are totally unrelated, hosted by different companies, etc.). The problem manifests as a certificate domain error.

When it happens, I can run nslookup mail.mydomain.com and I see the incorrect IP address (usually owned by either Apple or Akamai), but if I run nslookup mail.mydomain.com 8.8.8.8, I get the correct address. In fact, if I specify any of my computer's or router's DNS servers to nslookup, I get the correct address.

My real quest is to find out why this keeps happening, and to do that, I'd like to know which server is supplying me this bad DNS entry. Is there a way to check my DNS cache to see where this bad lookup came from?

link|improve this question
100% accept rate
Very hard to suggest any possible reason without the real domain name... dougbarton.us/DNS/bind-users-FAQ.html#RealNames – bortzmeyer Apr 13 '10 at 10:43
feedback

1 Answer

up vote 1 down vote accepted

Start Wireshark somewhere on your LAN, looking at traffic to your machine, then boot your machine, run nslookup, and watch at DNS traffic. You'll see where the bad entry comes from.

link|improve this answer
The problem is that I don't know which DNS server to query to get the bad response. When I query any of my DNS servers, I get the proper address. – Stephen Jennings Apr 13 '10 at 2:52
Run Wireshark while you do nslookup mail.mydomain.com -- it'll tell you which server's being queried. Note that you can run Wireshark on your own computer, it doesn't have to be somewhere else on the LAN; also, if you don't want to deal with installing Wireshark, you can just use the built-in tcpdump utility at the command line: sudo tcpdump -n -s0 port 53 – Gordon Davisson Apr 13 '10 at 19:27
I tried this tdoay; The incorrect DNS is coming from my router, so I guess it's just something my ISP's DNS servers are doing wrong. Oh well, I guess I'll just set my DNS servers manually. – Stephen Jennings Apr 25 '10 at 6:51
Check to see that the root servers are giving the correct authoritative servers for your domain. Just a guess, but could there be an old authoritative server with stale info that hasn't been removed from the list? – Fred Apr 26 '10 at 3:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.