3

I'm completely at a loss on this one.

I have a windows domain environment with 2 DNS servers, one on Windows Server 2008 R2 and one on Windows Server 2012.

Internal DNS resolution is fine. External resolution is fine as well, with one exception.

  • Any time I try to resolve Facebook.com in a browser, it fails.
  • This is domain wide, not restricted to my local machine.
  • NSLOOKUP returns Name: Facebook.com and no ip address on my local machine and the servers
  • I've checked the host files on my machine and both DNS servers.
  • I've ran /flushdns.
  • I went to both DNS servers and looked in the "Cached Lookups" section, and Facebook's A record is set to 127.0.0.1
  • After deleting the cached lookup and trying again I got the same result.
  • SSH'ing to the firewall and running DIG on the domain returns the following output:

    [HOSTNAME]:/# dig facebook.com
    
    ; <<>> DiG 9.9.6-P1 <<>> facebook.com
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29742
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;facebook.com.                  IN      A
    
    ;; AUTHORITY SECTION:
    facebook.com.           890     IN      SOA     [OFFSITE LOCATION].com. 
    hostmaster.[OFFSITE LOCATION].com. 14 900 600 86400 3600
    
    ;; Query time: 0 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Mon Jun 18 15:55:31 CDT 2018
    ;; MSG SIZE  rcvd: 121
    

The "Offsite Location" in the AUTHORITY section is a company that my company just acquired. It seems like their DNS server is responding as the authoritative server for Facebook, but I don't know enough about DNS to say for sure.

Aside from contacting them, where do I go from here?

1
  • Presumably the forwarders in your DNS server are set to the other company's DNS server. Change them to 8.8.8.8?
    – Paul
    Jun 19, 2018 at 13:37

1 Answer 1

1

Resolution was found literally minutes after posting:

I got in contact with the offsite location. Apparently, they do in fact black hole Facebook, and my DNS server had a forwarder setup to forward to them.

So they removed the entry and everything is fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .