I know the authoritative DNS servers for records of a domain. What I haven`t determined is where queries internal to our network are consulted for records. I do know there are other servers used, serving different values internally, and would like to determine their IP addresses or servernames. Even just the first one consulted would be a good start.

Assuming I flush my local DNS cache resolver first (ipconfig /flushdns and possibly nbtstat -R), is there a way to determine which hop in a tracert is the DNS (DHCP?) server that serves dns records within the network zone?

As a side note: I'm not sure if this is the same thing as a "serving a zone file", but gather the latter is related to more than just DNS. Comments welcome to clarify this.


Bind's dig tool will give you an answer:

$ dig
;; Query time: 9 msec
;; SERVER: fdcc:216f:1d2c::110#53(fdcc:216f:1d2c::110)
;; WHEN: Wed Jan 22 06:49:54 UTC 2014
;; MSG SIZE  rcvd: 239

The SERVER line has the address of the server that actually replied.

  • First stop is the firewall. Any chance dig can show one hop past that? – Dallas Jan 22 '14 at 13:54

Turns out that there was a "DNS conditional forwarder" in place that would send anyone internally to a specific DNS server.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.