1

If I open a browser and try to open a "lksdjklsdj" domain, I'm redirected to some IP address (217.115.192.15).

Also, if I ping "kslaxcsd", I also get a reply from the same IP, instead of "host unknown".

I've searched for spyware, hosts file, registry, ... and I can't find any reference to this IP address.

Is it perhaps up to my DNS who is serving me that IP!?

Update: I have set Google DNS in my network properties for the current connection (Windows 7), and I still get the same behaviour.

nslookup -debug blahblah.blah result:

------------
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

------------
Got answer:
    HEADER:
    opcode = QUERY, id = 2, rcode = NXDOMAIN
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.com, type = A, class = IN
    AUTHORITY RECORDS:
    ->  MY-COMPANY-NAME.com
    ttl = 1800 (30 mins)
    primary name server = ns1.MY-COMPANY-NAME.com
    responsible mail addr = dns.MY-COMPANY-NAME.com
    serial  = 2011010800
    refresh = 28800 (8 hours)
    retry   = 7200 (2 hours)
    expire  = 1209600 (14 days)
    default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
    opcode = QUERY, id = 3, rcode = NXDOMAIN
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.com, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  MY-COMPANY-NAME.com
    ttl = 1800 (30 mins)
    primary name server = ns1.MY-COMPANY-NAME.com
    responsible mail addr = dns.MY-COMPANY-NAME.com
    serial  = 2011010800
    refresh = 28800 (8 hours)
    retry   = 7200 (2 hours)
    expire  = 1209600 (14 days)
    default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
    opcode = QUERY, id = 4, rcode = NOERROR
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.eu, type = A, class = IN
    ANSWERS:
    ->  blahblah.blah.MY-COMPANY-NAME.eu
    internet address = 217.115.192.15
    ttl = 900 (15 mins)

------------
------------
Got answer:
    HEADER:
    opcode = QUERY, id = 5, rcode = NOERROR
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.eu, type = AAAA, class = IN

------------
Name:    blahblah.blah.MY-COMPANY-NAME.eu
Address:  217.115.192.15

5
  • Can you post the output from 'nslookup -debug nowhere.blah' Aug 7, 2011 at 15:40
  • I've edited the question and just replaced the name of my company with the text MY-COMPANY-NAME. Mind you, I am NOT at the office right now and I'm using home DSL line.
    – miyo
    Aug 7, 2011 at 15:51
  • Have you done a DNS flush AFTER you changed your DNS settings to Googles? "ipconfig /flushdns" from the command prompt?
    – TFM
    Aug 7, 2011 at 15:56
  • Yes, and /registerdns, and I've rebooted - of course :)
    – miyo
    Aug 7, 2011 at 15:58
  • 1
    It's not, it looks like a wildcard DNS entry. Aug 7, 2011 at 16:05

2 Answers 2

2

Looks to me like your company has a wildcard DNS entry setup, and your machine has a search list or domain set to be MY-COMPANY-NAME.eu

So, anything that doesn't resolve has MY-COMPANY-NAME.eu appended and tried again, and for some reason, there's a wildcard DNS entry for *.MY-COMPANY-NAME.eu so it will always resolve to that IP address.

4
  • I tried - same thing.
    – miyo
    Aug 7, 2011 at 15:33
  • Where can I see that setting or that search list? Is it a domain group policy?
    – miyo
    Aug 7, 2011 at 16:09
  • Out of my area that sorry, I just know why it's doing it. The other question is, does your company know it has a wildcard DNS entry on it's domain pointing to a Dutch hosting company. Removing that would also solve your issue, your search list is useful when trying to talk to other hosts in the same domain, but when you only want to use shortnames Aug 7, 2011 at 16:12
  • You are right, I'll talk to the network admins, thanks for the entire debugging session. :)
    – miyo
    Aug 7, 2011 at 19:46
1

Windows, like every other OS, maintains a list of "suffixes" to append automatically when doing DNS resolution. For example, if your computer is connected to example.com.'s network, it will have "example.com." in the suffix list. (This is useful when accessing other computers by name – you only need to type "mailserver" instead of "mailserver.example.com.", for example.)

However, Windows applies this to all non-absolute domain names – those that don't end with a . – and by default, it first tries with the suffix appended. So if you enter "does.not.exist", Windows tries "does.not.exist.example.com." first, and "does.not.exist." after that.

The problem is that your current domain has a wildcard record set up, which is automatically returned for all subdomains that don't exist. When you enter "does.not.exist", Windows tries "does.not.exist.example.com.", which will match the "*.example.com." wildcard.


One solution is to configure Windows to try appending "." before your company's domain. On Windows XP, open Network Connections, right-click your network interface, and choose Properties, then Internet Protocol (TCP/IPv4)PropertiesAdvancedDNS.

Choose the Append these DNS suffixes (in order) option, and add . (a single dot) as the first entry. Optionally, you can add MY-COMPANY-NAME.eu. below it. Finally, click OK.

Note that this setting is sometimes enforced by Group Policy; in this case, complain to your network administrators.

4
  • Other OS's do this optionally, it's not forced behaviour. My linux machine here doesn't append anything, unless you put a search entry into resolv.conf. Aug 7, 2011 at 16:14
  • @EightBitTony: Neither does Windows force you into it -- however, both Windows and most Linuxes do it by default. When I connect to my DHCP-enabled network, the default settings of dhcpcd are to add home. to the resolv.conf search list. Aug 7, 2011 at 16:24
  • Fine, but I think "Windows, like every other OS, maintains a list of "suffixes"" is misleading. Windows, like every other OS, may maintain a list of .... Aug 7, 2011 at 16:37
  • Excellent explanation @gravity, I wish I could accept both answers. Thanks.
    – miyo
    Aug 7, 2011 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .