nslookup - am I reading these results right?

Hi,


I have a Mini FileServer 10.11.6 bound to AD 2012R2. I have another DC setup in case the 1st one goes down.

dc.svr.ip.addx is the address of my "main" controller

dc2.svr.ip.addx is the address of my "backup" controller

(yes, I know primary and backup are no longer "things" but this is how I'm using them since dc2 is a lot slower than dc)


When I this is my result when I issue nslookup domain.local


Server: dc.svr.ip.addx

Address: dc.svr.ip.addx#53


Name: domain.local

Address: dc2.svr.ip.addx

Name: domain.local

Address: dc.svr.ip.addx

Does this mean my server is authenticating to dc2 1st? And if so, why? DC never went down that I can see.

Thanks,

Jeff

Many-OTHER, Xserves, MBPs, Minis, iMacs, etc

Posted on Dec 8, 2017 6:44 AM

Reply
3 replies

Dec 8, 2017 7:59 AM in response to Jeff at K2

If your DNS server configuration is returning multiple IP address translations for a given DNS host name and as is used for load balancing in some network environments, then it's indeterminate which translation is returned for a particular DNS query. What gets returned from the DNS server for a query is entirely up to the particular DNS server and its behavior and any local configuration customizations, including related details such as the Time To Live (TTL) setting.


Additionally, please do not use the .local TLD for local DNS; that tends to cause issues. Please use a real and registered domain. Microsoft unfortunately encouraged folks to squat in .local, and .local is now an allocated and real TLD. They've since remediated those recommendations. The .local TLD is used by and reserved to Zeroconf/Bonjour/mDNS usage. Mixing unicast DNS and multicast DNS doesn't always end well. As one of the Apple networking engineers that worked on Zeroconf/Bonjour/mDNS had commented a while back, "expect aggravation" when that usage happens.


If you're posting obfuscated details and are not really using the .local TLD here, then example.com, example.net and example.org are available for that, as are IP addresses 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3), or from one of the three private blocks. Using these names can make it easier to understand which details are intentionally obfuscated and which might be odd or might be a mistake, in particular.

Dec 11, 2017 8:34 AM in response to Jeff at K2

If the LDAP authentication is set to prefer a particular DNS host name for the domain server and the DNS server is returning multiple IP addresses for that specified DNS host name, it's indeterminate which LDAP server will be used. Which is what nslookup is showing, too. Now if multiple canonical host names (DNS A records) are specified as the authentication servers and not a DNS host name that's being load-balanced by the DNS infrastructure...

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

nslookup - am I reading these results right?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.