0

Is there any explanation for the following behavior?

$  dig @8.8.8.8 x.cnn.com

; <<>> DiG 9.11.1-P2 <<>> @8.8.8.8 x.cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52259
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;x.cnn.com.         IN  A

;; ANSWER SECTION:
x.cnn.com.      19  IN  A   6.9.6.9
x.cnn.com.      19  IN  A   1.1.1.1
    $  dig @8.8.8.8 x.cnn.com

; <<>> DiG 9.11.1-P2 <<>> @8.8.8.8 x.cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52259
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;x.cnn.com.         IN  A

;; ANSWER SECTION:
x.cnn.com.      19  IN  A   6.9.6.9
x.cnn.com.      19  IN  A   1.1.1.1

;; Query time: 326 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jul 10 20:39:22 CEST 2017
;; MSG SIZE  rcvd: 70
;; Query time: 326 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jul 10 20:39:22 CEST 2017
;; MSG SIZE  rcvd: 70

Why would you point the domain at 1.1.1.1 / 6.9.6.9? Is this some convention like example.org?

2

1 Answer 1

3

It looks like cnn.com uses Amazon Web Services (AWS) -hosted name servers as their authoritative name servers for the general cnn.com domain:

$ dig cnn.com soa
[…]
;; ANSWER SECTION:
cnn.com.        76  IN  SOA ns-47.awsdns-05.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400


…but those servers are configured to treat x.cnn.com (note, x is NOT a wildcard here, it is the literal letter 'x') as a subdomain, and queries for that subdomain are delegated to a different set of authoritative name servers: dmtns[01-05].turner.com (CNN is owned by Turner broadcasting):

$ dig @ns-47.awsdns-05.com. x.cnn.com
[…]
;; AUTHORITY SECTION:
x.cnn.com.      86400   IN  NS  dmtns01.turner.com.
x.cnn.com.      86400   IN  NS  dmtns02.turner.com.
x.cnn.com.      86400   IN  NS  dmtns03.turner.com.
x.cnn.com.      86400   IN  NS  dmtns04.turner.com.
x.cnn.com.      86400   IN  NS  dmtns07.turner.com.

…and it appears those dmtnsXX.turner.com DNS servers contain 'A' records (name-to-IPv4-address mapping records) pointing x.cnn.com to 6.9.6.9 and 1.1.1.1:

$ dig @dmtns01.turner.com. x.cnn.com
[…]
;; ANSWER SECTION:
x.cnn.com.      20  IN  A   1.1.1.1
x.cnn.com.      20  IN  A   6.9.6.9

I tried a few other [a-z].cnn.com domains and didn't discover any others that were set up the way x was.

I'm guessing x.cnn.com was some kind of internal testing sandbox among CNN/Turner's IT department that accidentally leaked out to the real world, but there's no way to know for sure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .