Why do Ping and Dig provide different IP address than nslookup?

When pinging my domain name which points to my home public IP from two different servers on my LAN, it shows them pinging different IP. Further investigation shows dig and nslookup providing different results. See below.

A little history. My IP used to be 11.22.33.444 and is hosted by Comcast. I changed routers, and it somehow got changed to 55.66.77.888. I've since updated my 1and1 domain name to point to the 55.66.77.888. desktop is a basic server, runs the web server, and connects wirelessly to my LAN. laptop is a GUI and connected via CAT5. Both operate Centos6.4. My old router was a D-Link, and used their "Virtual Server" feature to pass port 80 to desktop. My new router is a Linksys, and I use their "Port Forwarding" feature to pass port 80 to desktop (however, I haven't gotten this part working yet).

What is going on??? Why the different IPs? Obviously, it most somehow be stored on the server, but why does the actual machine even know the public IP since it is on a LAN? How do I purge the old IP?

[root@desktop etc]# dig +short myDomain.com
11.22.33.444
[root@desktop etc]# nslookup www.myDomain.com
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   www.myDomain.com
Address: 55.66.77.888

[root@desktop etc]# dig myDomain.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.6 <<>> myDomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13822
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;myDomain.com.                    IN      A

;; ANSWER SECTION:
myDomain.com.             16031   IN      A       11.22.33.444

;; Query time: 21 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Oct 21 04:36:52 2013
;; MSG SIZE  rcvd: 44

[root@desktop etc]#


[root@laptop ~]# dig +short myDomain.com
55.66.77.888
[root@laptop ~]# nslookup www.myDomain.com
Server:         192.168.0.1
Address:        192.168.0.1#53

Non-authoritative answer:
Name:   www.myDomain.com
Address: 55.66.77.888

[root@laptop ~]#

user1032531

Posted 2013-10-21T17:15:34.733

Reputation: 1 331

Answers

nslookup on the Desktop is querying 8.8.8.8 which is a public DNS server, which would know the public address of the domain.

nslookup on the Laptop is querying 192.168.0.1, which is a local DNS server and is configured differently.

I can't tell which server dig is querying since you used the +short option. You need to find out first what server dig on your Desktop is using, then you can go on to fix the record there.

daxlerod

Posted 2013-10-21T17:15:34.733

Reputation: 2 575

Thanks daxlerod. Please see updated dig without -short. – user1032531 – 2013-10-21T17:37:08.777

1@user1032531, it looks like the Google DNS server (8.8.8.8) has cached your old IP address, so you either wait for the TTL (16031 seconds) to expire, or switch to another DNS server that either doesn't have the domain in its cache or has the new address. – Cristian Ciupitu – 2013-10-21T17:42:45.977

I didn't realize that such a thing happens. So, was I correct that my server never really knew the IP of the domain name? Also, is it normal for Google to cache the IP? Wouldn’t it cause every time an IP change to be a bad thing? Also, what is the purpose of Google caching it? Thanks – user1032531 – 2013-10-21T20:22:28.983

If your computer and rDNS didn't cache then every single packet sent to a hostname would result in a query from your computer to to your rDNS server, which would then have to query the root servers for (in this case) .com in order to find out the auth name-servers for mydomain.com; then your rDNS would have to query those auth name-servers for www.mydomain.com. Each query adds latency but each query also costs bandwidth and CPU. A tiny amount of each but it adds up - think about all those Facebook users hammering Google's DNS servers when they're loading up their walls, for example! – Dermot Williams – 2013-10-22T09:27:28.930

To answer your other question - IP addresses should change infrequently enough that caching and TTLs aren't a problem; most people just plan around the TTL when they're making this kind of change. – Dermot Williams – 2013-10-22T09:29:24.233

In your example, you are DIGging for mydomain.com and running nslookup for www.mydomain.com.

mydomain.com and www.mydomain.com are seperate A records and in this case they appear to be pointing at different IP addresses.

Dermot Williams

Posted 2013-10-21T17:15:34.733

Reputation: 416

Good point. There was a lot of variability in the way the queries were executed, different tools, different DNS servers, and different domains. – daxlerod – 2013-10-22T13:21:18.820