Yesterday was a weird day. Nothing seemed to go as it should have. My coworker Marius noticed that one of my domains was not responding anymore. We tried to ping it. But forgot that our admins block outbound ICMP packages. At least we could see the domain resolved to the correct IP address.
So we did a lookup on the domain. No weird things here. Then we decided to ping the name servers to see if they were responding. They were. But there was something strange. The domain in question runs on two name servers. namely ns1.cker.sc and ns2.cker.sc. ns1 was responding correctly. ns2 however was responding with a totally different and unknown IP address. This is weird. The normal settings would be:
ns1.cker.sc ( 208.69.125.116 )
ns2.cker.sc ( 208.69.125.117 )
ns2 however responded with 208.69.34.132. The whois database at ripe.net told us it was in the IANA pool of addresses. But we couldn’t find a whois tool there. So i opened up a browser to go directly to this IP address. This showed a temporary OpenDNS page. Off to domaintools.com to do a reverse lookup on this IP.
This revealed one domain matching this IP address. Some weird long domain name. At first i was thinking somebody highjacked my DNS server or maybe some DNS cache poisoning. But after looking closely i noticed the domain was actually readable. The domain returned was : Caffefiaschetteriaitaliana.com. A google search returned some italian cafe with almost the same domain. fiaschetteriaitaliana.it.
So we decided to do a whois query on the .com domain. This revealed some email addresses with similar domains. And technical contacts from aruba.it. By now we had the feeling somebody made a configuration error. So i decided to send an email to all the addresses matching this domain including OpenDNS. And after about an hour the nameserver was responding correctly again. So they either corrected a mistake or it was just a temporary fluke. I never got a reply from any of the addresses i wrote to.
Although i’m happy the nameservers are responding properly again. I’m still stuck with the question. What the hell happened here? The most logical scenario for me is still a configuration error.
UPDATE: 12-08-2008
After some digging. I found out that the ip address “208.69.34.132″ actually belongs to opendns.com. When a non existing sub -/ domain is quieried. This ip is returned. It’s just a way to make money from ads. the network i was connected to at that moment uses an opendns.com DNS cache server. That explains that part.



Thijs Lensselink is a PHP developer, consultant and all out open source enthusiast.
He has over 12+ years of experience in building and maintaining web applications mostly
on linux/Unix/BSD platforms. Besides a full time job he does freelance work with his ...