My Actiontec MI424WR rev. D router hands out two DNS server addresses:

  1. [primary] itself
  2. [secondary] the ISP's. I assume this is the same DNS server auto-configured on the WAN interface

The router itself provides a dynamic dns service, for resolving local network hosts (from DHCP requests).

This is the problem:

  1. localhost1 queries: "get IP of localhost2"
  2. primary name server responds: "local IP"
  3. secondary name server responds: "external IP"

If the secondary name server responds first, then I am stuck with a bogus IP until the cache (TTL) expires. If the primary name server responds first, then name resolution only works for as long as the TTL. In either case this leads to intermittent networking problems.

I think the problem is that the primary name server is not authoritative for the local network, and that this is solvable using a zone file. That said, I have no idea how.

Edit: More information:

  1. local IPv4 interface settings:

    $ nmcli dev list iface eth0 | grep -i ip4
    IP4.ADDRESS[1]:                         ip =, gw =
    IP4.DOMAIN[1]:                          home
  2. Router DHCP lease (notice two DNS servers)

    DHCP lease

  3. Result and packet capture of "ping veridian" with correct results:

    $ host veridian
    veridian.home has address

    In this case, both DNS server are queried. Notice ICMP packet:

    DNS Query working #1

    But sometimes, only the first is queried:

    DNS Query working #2

  4. Result and packet capture of "ping veridian" with incorrect results:

    $ host veridian
    veridian has address
    Host veridian not found: 3(NXDOMAIN)

    DNS Query not working #1

  5. dig queries with correct results:

    $ dig veridian
    ; <<>> DiG 9.9.5-4.3ubuntu0.1-Ubuntu <<>> veridian
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41955
    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
    ;veridian.                      IN      A
    veridian.               3600    IN      A
    ;; Query time: 8 msec
    ;; SERVER:
    ;; WHEN: Thu Jan 01 11:49:15 EST 2015
    ;; MSG SIZE  rcvd: 42

    I don't understand why +trace breaks so badly. The packet capture is just as crazy

    $ dig veridian +trace
    ; <<>> DiG 9.9.5-4.3ubuntu0.1-Ubuntu <<>> veridian +trace
    ;; global options: +cmd
    .                       3600    IN      NS      FWDR-12.FWDR-0.FWDR-250.FWDR-71.
    .                       3600    IN      NS      FWDR-12.FWDR-0.FWDR-242.FWDR-71.
    ;; Received 192 bytes from in 52 ms
    .                       59753   IN      NS      f.root-servers.net.
    .                       59753   IN      NS      g.root-servers.net.
    .                       59753   IN      NS      h.root-servers.net.
    .                       59753   IN      NS      i.root-servers.net.
    .                       59753   IN      NS      a.root-servers.net.
    .                       59753   IN      NS      j.root-servers.net.
    .                       59753   IN      NS      b.root-servers.net.
    .                       59753   IN      NS      c.root-servers.net.
    .                       59753   IN      NS      k.root-servers.net.
    .                       59753   IN      NS      d.root-servers.net.
    .                       59753   IN      NS      l.root-servers.net.
    .                       59753   IN      NS      m.root-servers.net.
    .                       59753   IN      NS      e.root-servers.net.
    ;; Received 456 bytes from in 424 ms
    .                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2015010100 1800 900 604800 86400
    .                       86400   IN      RRSIG   SOA 8 0 86400 20150108050000 20150101040000 16665 . 41iHbkp6Vgt/jpFPBSSHhsZJIObLML1kpg9Zr1SwMGKKutBdx2RdSevT Al5360iNAVIPgfNNv9bfaP5U1HJ37HbRgn
    /PWNZ6rxWGeVr4nW/O7TTH Z5byVvNyai9h/j9FPkN4q7/+5C+iNioJtlBfoHQTSRLhcUNBqdUttTuk 89k=
    .                       86400   IN      NSEC    abogado. NS SOA RRSIG NSEC DNSKEY
    .                       86400   IN      RRSIG   NSEC 8 0 86400 20150108050000 20150101040000 16665 . tNCuLf6B7DspHqAbfBa2dTuIYpPqCJt0++du62VuUJOmcVKdxgupwGFm +MX5zjpegWVkNf2PciMWScSx94FBbRNPu
    ve4yHDCBZnL/T+FW5SoRGHI 9XUGHkO6Q+74iBpzXS3Sbgh/FAXI8MbXo2aM+utAZqowi2yYmN6KS5T5 Yic=
    ventures.               86400   IN      NSEC    versicherung. NS DS RRSIG NSEC
    ventures.               86400   IN      RRSIG   NSEC 8 1 86400 20150108050000 20150101040000 16665 . gRxYslNhKmdOYOVB0EIf091y+4JbnO7+CrMMKXTmx3nmPQSTjuoBg6xx ngbJ+BNflGYMgFkI7PEJCCJNdgpaSYY3S
    TIfy6nfZng7pD5MVjlFV4YJ IN7Q9gNK0GhSdUxzOerpQn9Lud0Ync2XRnAO1ErLOVGg81vXpdakYssB fy0=
    ;; Received 658 bytes from in 115 ms
  6. dig queries with incorrect results:

    $ dig veridian +trace
    ; <<>> DiG 9.9.5-4.3ubuntu0.1-Ubuntu <<>> veridian +trace
    ;; global options: +cmd
    .                       3600    IN      NS      FWDR-12.FWDR-0.FWDR-250.FWDR-71.
    .                       3600    IN      NS      FWDR-12.FWDR-0.FWDR-242.FWDR-71.
    ;; Received 192 bytes from in 52 ms
    veridian.               0       IN      A
    ;; Received 53 bytes from in 10 ms
  7. Screenshot of the router's bridge (internal) interface settings. There are no DNS settings on the individual (bridged) interfaces:

    Router bridge interface

  8. Screenshot of the router's WAN (external) interface settings. Notice the DNS settings. I'm pretty sure if I disable "Obtain DNS Server address automatically" I won't be able to resolve external DNS names:

    Router WAN interface

  9. The router also provides "Dynamic Routing". I'm pretty sure it isn't applicable, but thought I should mention it just in case. I can also manually edit the DNS cache (hostnames -> internal IP addresses), and there is a "Dynamic DNS" configuration page which I don't understand. It looks like an external DDNS service (DynDNS, No-IP, etc) but without any functionality:

    Router Dynamic DNS settings

  • can you take a pic of that? I mean in your modem's config page
    – TechLife
    Jan 1, 2015 at 7:19
  • TWO DNS servers? How is DNS related to DHCP related to routing? Forgive me, but am I missing a bit here? I always assumed DNS/DHCP pairs, and routing to be another matter? I guess when it comes to terminology used at the moment it should all make a difference. In minds of people yes, in technology --?
    – arch-abit
    Jan 1, 2015 at 7:56
  • If your primary DNS server is the router itself, do you need the ISP DNS server? What happens if you remove the secondary DNS server.
    – Corb3nik
    Jan 1, 2015 at 8:07
  • Different IP but the same DNS records, the second is a backup only of the same. Point your clients/servers to the 'router' (ISP) DNS, or if your are running your own DNS inside a local network point your clients/servers there. Your internal clients/servers are going to be pointed 'routed' to your ISP's (router).
    – arch-abit
    Jan 1, 2015 at 8:14
  • On 802 Ethernet and the rest (Gigabit Ethernet) DNS knows the clients by name, the ROUTER is just like the postal service.. It knows nothing except how to deliver.
    – arch-abit
    Jan 1, 2015 at 8:25

2 Answers 2


Kind of an odd way to set up the router. More normal to set up the dhcp server on the router to hand out it's own ip address for dns server and then it will relay the dns requests to the servers in the router setup. Typically the router setup will get the dns servers populated by the isp - I'm using the same router, though rev I, with Verizon FIOS. Otherwise if you want to use a third party dns server like google or open dns then set up the dhcp server to hand out a pair of addresses for whatever servers you want to use or alternatively override the dhcp assignment to the servers you want to use.Are you also a FIOS user?

The dynamic dns page is as you surmise to support use of something like dyndns. Fill in your account details and when the external wan ip address changes dydndns will get the update.

On screenshot 7 where you show dns values of I have valid values - albeit they are actually values for a pair of OpenDns servers. I don't understand how dns works at all for you with 0 values. It's a long time since I set the router up but I believe if you change the drop down to No DNS Servers then the router will default to using the dns servers that are associated with the ISPs dhcp server that granted the lease.

  • Yes, also a FIOS user. Apparently having "Use the Following DNS Server Addresses" set to both is equivalent to "No DNS Server". So, with "No DNS Server" the DHCP server hands out the same DNS servers: primary being the router's and secondary being the ISP's. In other words, I still have the problem.
    – user19087
    Jan 1, 2015 at 21:33
  • With "No DNS Server" also set on the WAN (external) interface - that is, "No DNS Server" now set on all interfaces - the router still hands out it's IP as the primary nameserver and the ISP's as the secondary nameserver.
    – user19087
    Jan 1, 2015 at 21:40
  • I'm assuming local name resolution works for you. Just out of curiosity, is your local domain (Advanced->System-Settings->Router-Status) unset? As you can see, mine is set to "home". Of course, that is correctly advertised via DHCP, so it shouldn't be a problem.
    – user19087
    Jan 1, 2015 at 21:43
  • So your clients are given - [1] Your router's IP [2] an OpenDNS IP - as nameservers and there are no contradictions/problems?
    – user19087
    Jan 1, 2015 at 21:51
  • No, with the Use following DNS server set the dhcp server gives the the client the router address ( as the dns server and the router uses the 2 opendns server addresses in the setting to resolve the addresses.
    – Peter
    Jan 2, 2015 at 18:37

Having your router give out two DNS addresses that don't agree on addresses is bad.

Your router needs to give out 1 DNS address which would be itself only, it sounds like your router's DNS server handles local network names.

I think the problem is that the primary name server is not authoritative for the local network, and that this is solvable using a zone file.

If your primary server is resolving local IPs to local names when it's being queried, and you aren't getting failed DNS respones, it already is authoritative. The problem is some queries are going to the router's DNS and others to your ISP's DNS. DHCP supports giving multiple DNS servers out, but this doesn't mean those DNS servers have to be related or know about each other.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.