☰

为什么 ping FQDN 失败，但 dig 却可以成功？

tag-icon • tag-icon domain-name-system ping host dig
为什么 ping FQDN 失败，但 dig 却可以成功？

当我尝试 ping 某个 FQDN 时，失败了：

$ ping test-customer-1.clients.jsonar.com
ping: test-customer-1.clients.jsonar.com: Name or service not known

然而，diget al. 成功了：

$ dig test-customer-1.clients.jsonar.com

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> test-customer-1.clients.jsonar.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57830
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;test-customer-1.clients.jsonar.com. IN A

;; ANSWER SECTION:
test-customer-1.clients.jsonar.com. 3119 IN CNAME _r1.clients.jsonar.com.
_r1.clients.jsonar.com. 3119    IN  CNAME   _w1.clients.jsonar.com.
_w1.clients.jsonar.com. 3119    IN  A   3.209.217.53

;; Query time: 15 msec
;; SERVER: 192.168.1.99#53(192.168.1.99)
;; WHEN: Fri Apr 12 15:44:21 PDT 2019
;; MSG SIZE  rcvd: 115

$ nslookup test-customer-1.clients.jsonar.com.
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
test-customer-1.clients.jsonar.com  canonical name = _r1.clients.jsonar.com.
_r1.clients.jsonar.com  canonical name = _w1.clients.jsonar.com.
Name:   _w1.clients.jsonar.com
Address: 3.209.217.53

$ host test-customer-1.clients.jsonar.com
test-customer-1.clients.jsonar.com is an alias for _r1.clients.jsonar.com.
_r1.clients.jsonar.com is an alias for _w1.clients.jsonar.com.
_w1.clients.jsonar.com has address 3.209.217.53

文件：

$ cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.1.99
nameserver 8.8.8.8

$ cat /etc/sysconfig/network-scripts/ifcfg-enp0s31f6 
TYPE="Ethernet"
BOOTPROTO="dhcp"
DEFROUTE="yes"
PEERDNS="yes"
PEERROUTES="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_PEERDNS="yes"
IPV6_PEERROUTES="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="enp0s31f6"
UUID="cf566dc0-de91-497d-a045-560fddfbaf3e"
DEVICE="enp0s31f6"
ONBOOT="yes"
DNS1=8.8.8.8

$ cat /etc/nsswitch.conf | grep hosts
#hosts:     db files nisplus nis dns
#hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname
hosts:      files dns myhostname

编辑：

$ getent hosts test-customer-1.clients.jsonar.com
$ echo $?
2
# According to the man page, exit code 2 means: 
# One or more supplied key could not be found in the database

从 Linux 机器 ping 操作失败，但从 Windows 机器 ping 操作成功。

答案1

事实证明，问题是由一个相当奇怪的配置错误引起的：
test-customer-1.clients.jsonar.comDNS 中的记录国家标准而不是A记录。（似乎 Windows 并不关心，这就是为什么来自 Windows 计算机的 ping 操作成功，但 *nix 却将这种错误配置（正确地）视为可能的安全漏洞，并导致 ping 操作失败）。

曾经test-customer-1.clients.jsonar.com在 DNS 中注册过A记录，问题已解决。

相关内容