On 2019-10-23 17:52, JJ wrote:

Wireshark shows that Windows' nslookup only uses the specified name server
for query. Yet, an answer is replied from the specified name server. I
tested it using 10.0.0.x as the name server.

FYI... my system uses Dnscrypt and it's bound to 127.0.0.1. My system's DNS
setting is set to 127.0.0.1 for primary and nothing for secondary. My LAN
uses 192.168.1.x range and my NIC is at 192.168.1.2 with 192.168.1.1 as the
gateway (my router). I stopped Dnscrypt before I test nslookup.

Even with debug logging enabled, nslookup doesn't show where the answer
actually came from. I also can't find any option to disable that weird
behaviour.

So I am not alone! Where are you located? I suspect maybe it's the great
firewall that actually answered, but if you are not in china, then maybe
it's the weirdness (or feature?) of Windows.

--
Regards,
Lu Wei
IM:
PGP: 0xA12FEF7592CCE1EA