Process of DNS resolution using nslookup starting from root nameservers

Question

I understand broadly the theory of how a DNS resolver goes through the domain hierarchy querying nameservers to resolve a domain name from the root namespace downwards however I would like to try doing a similar process by using nslookup to find google.com name servers (or any other domain name as an example). I understand that I can just do:

nslookup -type=ns google.com

which will return all of google.com's nameservers such as ns1.google.com, ns2.google.com etc.

However, what I want to do instead is go from the root level domain and recursively get to Google's nameservers similar to what a DNS resolver would normally do (assuming no cache hit).

Here's the process I've tried:

1. First get the root level nameservers:

   nslookup -type=ns .

   This returns all 13 root servers and I have chosen one of them: 192.36.148.17

2. Now I query the root nameserver for the gTLD .com as follows:

   nslookup -type=ns com 192.36.148.17

   This returns a list of nameservers ie IP: 199.212.0.73

3. I now use the first nameserver's IP to query for the SLD's name servers:

   nslookup -type=ns google.com 199.212.0.73

Here I would have thought this would return google.com's nameservers but instead I'm getting nameservers such as v.arin.net, u.arin.net etc. What am I missing here?

Answer 1

The seems to be because your using the IP from an arpa and not a gtld server at step 3, below is what I did and seemed to work fine, using any ip from the arpa returns the same as you encountered.

1) nslookup -type=ns .

nslookup -type=ns .
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
(root)  nameserver = a.root-servers.net
(root)  nameserver = b.root-servers.net
(root)  nameserver = c.root-servers.net
(root)  nameserver = d.root-servers.net
(root)  nameserver = e.root-servers.net
(root)  nameserver = f.root-servers.net
(root)  nameserver = g.root-servers.net
(root)  nameserver = h.root-servers.net
(root)  nameserver = i.root-servers.net
(root)  nameserver = j.root-servers.net
(root)  nameserver = k.root-servers.net
(root)  nameserver = l.root-servers.net
(root)  nameserver = m.root-servers.net

2) Resolve IP

Pinging i.root-servers.net [192.36.148.17] with 32 bytes of data:
Reply from 192.36.148.17: bytes=32 time=30ms TTL=53
Reply from 192.36.148.17: bytes=32 time=27ms TTL=53
Reply from 192.36.148.17: bytes=32 time=27ms TTL=53
Reply from 192.36.148.17: bytes=32 time=30ms TTL=53

Ping statistics for 192.36.148.17:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 27ms, Maximum = 30ms, Average = 28ms

3) nslookup -type=ns com 192.36.148.17

nslookup -type=ns com 192.36.148.17
in-addr.arpa    nameserver = e.in-addr-servers.arpa
in-addr.arpa    nameserver = c.in-addr-servers.arpa
in-addr.arpa    nameserver = d.in-addr-servers.arpa
in-addr.arpa    nameserver = b.in-addr-servers.arpa
in-addr.arpa    nameserver = f.in-addr-servers.arpa
in-addr.arpa    nameserver = a.in-addr-servers.arpa
a.in-addr-servers.arpa  internet address = 199.212.0.73
a.in-addr-servers.arpa  AAAA IPv6 address = 2001:500:13::73
b.in-addr-servers.arpa  internet address = 199.253.183.183
b.in-addr-servers.arpa  AAAA IPv6 address = 2001:500:87::87
c.in-addr-servers.arpa  internet address = 196.216.169.10
c.in-addr-servers.arpa  AAAA IPv6 address = 2001:43f8:110::10
d.in-addr-servers.arpa  internet address = 200.10.60.53
d.in-addr-servers.arpa  AAAA IPv6 address = 2001:13c7:7010::53
e.in-addr-servers.arpa  internet address = 203.119.86.101
e.in-addr-servers.arpa  AAAA IPv6 address = 2001:dd8:6::101
f.in-addr-servers.arpa  internet address = 193.0.9.1
f.in-addr-servers.arpa  AAAA IPv6 address = 2001:67c:e0::1
Server:  UnKnown
Address:  192.36.148.17

com     nameserver = j.gtld-servers.net
com     nameserver = i.gtld-servers.net
com     nameserver = g.gtld-servers.net
com     nameserver = e.gtld-servers.net
com     nameserver = h.gtld-servers.net
com     nameserver = m.gtld-servers.net
com     nameserver = b.gtld-servers.net
com     nameserver = d.gtld-servers.net
com     nameserver = k.gtld-servers.net
com     nameserver = a.gtld-servers.net
com     nameserver = l.gtld-servers.net
com     nameserver = f.gtld-servers.net
com     nameserver = c.gtld-servers.net
a.gtld-servers.net      internet address = 192.5.6.30
a.gtld-servers.net      AAAA IPv6 address = 2001:503:a83e::2:30
b.gtld-servers.net      internet address = 192.33.14.30
b.gtld-servers.net      AAAA IPv6 address = 2001:503:231d::2:30
c.gtld-servers.net      internet address = 192.26.92.30
d.gtld-servers.net      internet address = 192.31.80.30
e.gtld-servers.net      internet address = 192.12.94.30
f.gtld-servers.net      internet address = 192.35.51.30
g.gtld-servers.net      internet address = 192.42.93.30
h.gtld-servers.net      internet address = 192.54.112.30
i.gtld-servers.net      internet address = 192.43.172.30
j.gtld-servers.net      internet address = 192.48.79.30
k.gtld-servers.net      internet address = 192.52.178.30
l.gtld-servers.net      internet address = 192.41.162.30
m.gtld-servers.net      internet address = 192.55.83.30

4) nslookup -type=ns google.com 192.5.6.30

nslookup -type=ns google.com 192.5.6.30
(root)  nameserver = a.root-servers.net
(root)  nameserver = b.root-servers.net
(root)  nameserver = c.root-servers.net
(root)  nameserver = d.root-servers.net
(root)  nameserver = e.root-servers.net
(root)  nameserver = f.root-servers.net
(root)  nameserver = g.root-servers.net
(root)  nameserver = h.root-servers.net
(root)  nameserver = i.root-servers.net
(root)  nameserver = j.root-servers.net
(root)  nameserver = k.root-servers.net
(root)  nameserver = l.root-servers.net
(root)  nameserver = m.root-servers.net
Server:  UnKnown
Address:  192.5.6.30

google.com      nameserver = ns2.google.com
google.com      nameserver = ns1.google.com
google.com      nameserver = ns3.google.com
google.com      nameserver = ns4.google.com
ns2.google.com  internet address = 216.239.34.10
ns1.google.com  internet address = 216.239.32.10
ns3.google.com  internet address = 216.239.36.10
ns4.google.com  internet address = 216.239.38.10