mjhjmtu

I'm debugging a DNS resolution error for the domain auth.otc.t-systems.com with Cloudflare's server, but got stuck. The strange thing is that the lookup succeeds/fails depending on the machine that runs the query, but I can't figure out where the configuration differs.

The failure is always with following message: server can't find auth.otc.t-systems.com: SERVFAIL

1.1.1.1 is Cloudflare's DNS.

What I've tried so far:

• Running nslookup auth.otc.t-systems.com 1.1.1.1 on various machines:
  
  
  • It fails on my machine with work & home internet (however it succeeds with Google's DNS in both cases).
  
  
  • It fails on a colleagues machine with work internet.
  
  
  • It succeeds in a ssh session to a remote server.
  
  


• Now I would assume that there is some strange configuration on our work internet, that causes the lookup to fail. However I don't know what I should look for and I've also found some online nslookup services that fail as well:
  
  
  • Fails:
    https://network-tools.com/nslook/Default.asp?domain=auth.otc.t-systems.com&type=1&server=1.1.1.1&class=1&port=53&timeout=5000&go.x=21&go.y=13
    
  
  
  • Works: http://www.kloth.net/services/nslookup.php
    
  
  

Any hints how I can further debug this?

Try using dig. Twenty years ago they tried to deprecate nslookup, but its firmly ingrained into muscle memory now and impossible to get rid of, but dig is far superior. For example.

dig +trace auth.otc.t-systems.com @1.1.1.1

Will trace the resolution fully for you, and you can see where they differ.

Network people have used for ages 1.1.1.1 as a replacement to another private address in random interfaces of switches/routers APs. (I am myself on a location at this moment where the public facing IP adress of the hundreds of wireless APs is 1.1.1.1 )

I bet my money in the machines you are not able to talk to Cloufare's 1.1.1.1 that you have an (imtermediate) route there for such interface.

For instance, in my case, 1.1.1.1 is giving me my IP address:

$ sudo tcpdump -i any -n host 1.1.1.1 and port 67
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:11:51.037186 IP 1.1.1.1.67 > 10.x.x.x.68: BOOTP/DHCP, Reply, length 296
13:11:51.037250 IP 1.1.1.1.67 > 10.x.x.x.68: BOOTP/DHCP, Reply, length 296