DNS errors come in different kinds. The status line and the messages from dig show whether the server said "no" or did not answer at all.
What dig prints |
What it means |
|---|---|
status: NOERROR, a record in ANSWER SECTION |
the server knows the name |
status: NOERROR, ANSWER: 0 |
the name exists, but has no record of this type |
status: NXDOMAIN |
the server answered: there is no such name |
status: SERVFAIL |
the server could not find an answer |
connection refused, no servers could be reached |
no answer: there is no DNS server at that address |
Try it on the machine: an unknown name on a working server, and a question to an address with no server.
The first question gets NXDOMAIN, an answer from a working server. The second gets no answer: dig prints connection refused three times. That is how 127.0.0.9 stayed silent for the resolver at the start of the lesson.
dig @127.0.0.2 shop.lab.test printed this status in the answer header. What did the server say?
opcode: QUERY, status: NXDOMAIN, id: 11461-
That would be
status: NOERRORwith an emptyANSWER SECTION.NXDOMAINmeans there is no such name at all. -
A server that is down sends no status:
digprintsconnection refusedandno servers could be reached. -
A server failure is
status: SERVFAIL.NXDOMAINis an ordinary "no such name" answer.
NXDOMAIN is an answer from a working server: it has no such name in its records. So the server is fine, and the mistake is in the name or in the choice of server.
Key points
-
NXDOMAINandSERVFAILcome from a working server, whileno servers could be reachedmeans there was no answer at all. -
A short answer without the status explains little: read the
statusline andANSWER SECTION.