On Tue, 22 Oct 2019 20:40:46 -0700, Mike Easter wrote:
Lu Wei wrote:
I accidentally found that "nslookup" works even if I specify a
non-existent dns server. For example "lookup www.kingoffighters.com
202.30.50.1" will return nothing for the first time but return correct
result for the second. 202.30.50.1 is just a random typed address.* Is
this normal?

My linux nslookup uses the default sequence of nameservers if the
command designated one doesn't work/ fails. If the first default fails
then it uses the next, etc.

Likely Win has a similar strategy.

Wireshark shows that Windows' nslookup only uses the specified name server
for query. Yet, an answer is replied from the specified name server. I
tested it using 10.0.0.x as the name server.

FYI... my system uses Dnscrypt and it's bound to 127.0.0.1. My system's DNS
setting is set to 127.0.0.1 for primary and nothing for secondary. My LAN
uses 192.168.1.x range and my NIC is at 192.168.1.2 with 192.168.1.1 as the
gateway (my router). I stopped Dnscrypt before I test nslookup.

Even with debug logging enabled, nslookup doesn't show where the answer
actually came from. I also can't find any option to disable that weird
behaviour.