The answer is that the .au registry has NS (delegation) records for the webcity.com.au servers, but those servers return NS records for the instanthosting.com.au servers. As you observed, they have the same IPs.
This can be shown using "dig +trace":- >; <<>> DiG 9.11.17 <<>> +trace @a.root-servers.net trubuiltpambula.com.au >; (1 server found) >;; global options: +cmd >. 518400 IN NS a.root-servers.net. >. 518400 IN NS b.root-servers.net. >. 518400 IN NS c.root-servers.net. >. 518400 IN NS d.root-servers.net. >. 518400 IN NS e.root-servers.net. >. 518400 IN NS f.root-servers.net. >. 518400 IN NS g.root-servers.net. >. 518400 IN NS h.root-servers.net. >. 518400 IN NS i.root-servers.net. >. 518400 IN NS j.root-servers.net. >. 518400 IN NS k.root-servers.net. >. 518400 IN NS l.root-servers.net. >. 518400 IN NS m.root-servers.net. >. 518400 IN RRSIG NS 8 0 518400 20200502050000 >20200419040000 48903 . >g9774YgRJPvtetwzUTOSXxImvqUKt4jgg/QMu6GnlGcKJ8hbJKCrLddP >3uSFI3G/ZF57CUySqHIqIvQ8kA13Yg23LCWMOESQp0D6wqdd0xn6JbKg >own+lH/PAjUw9ZHm0IolUrpbg8ig2pbLR7jv3XG9w9s4fV1GRjK+o26q >/DXhswFWtQs4zV6sKg13rroWsPiU7frVcAg0wenhwjHvuFRAiMI6CXsv >n4+PVLE69PtZ3cZjHYio7aUfFS7qmWvxjz7EAG1HLckRkyLms6PjDXBt >3ao9bERrU/PD/oZ8VwIZlPTNhrJOdte4fZSOLc1/cEQtnBLAN0xtmsOs do+8Bw== >;; Received 1097 bytes from 198.41.0.4#53(a.root-servers.net) in 14 ms > >au. 172800 IN NS a.au. >au. 172800 IN NS c.au. >au. 172800 IN NS d.au. >au. 172800 IN NS m.au. >au. 172800 IN NS n.au. >au. 172800 IN NS q.au. >au. 172800 IN NS r.au. >au. 172800 IN NS s.au. >au. 172800 IN NS t.au. >au. 86400 IN DS 18875 8 1 >A6362D938429477C0F5E51E1F47A3516B39D281B >au. 86400 IN DS 18875 8 2 >FE773B2F77BB6A6DD31BA27EB19E8F64257937622CAB98F3926EE77F EA2BE79F >au. 86400 IN RRSIG DS 8 1 86400 20200502050000 >20200419040000 48903 . >ozt+mtkvvSWbIMYHhRMG6r8PKUyJae+uvnod6us3H+9ogWt8XeAzuHDy >mhxlkRaizuOnzqRIqzeGF4O79Ei/dCuj8zH5koAWMvL6UqtsWvHHNhE9 >RaJ9TD1uF7FP9EtqGLpuXQe4q79appim3zUZahKszfxLLagvMR5JLOnI >tlhByeQUw3Y6c6u5NiDCMxtGa4n9JORdR/k+lwjfoMLqMsyUMvdG9D6b >2kJb3P2COEVnIGcvlW9KqZKMeQj+EU/pL+DVCosE4dINfE3gzAsQVpIv >uWE43+NlLYhUaY1Y/3suBuPQ7u5xW0Ujj5SApTTIoM4xlCRq7UgEr0/D TxgrTg== >;; Received 962 bytes from 192.58.128.30#53(j.root-servers.net) in 14 ms > >trubuiltpambula.com.au. 900 IN NS ns3.webcity.com.au. >trubuiltpambula.com.au. 900 IN NS ns2.webcity.com.au. >trubuiltpambula.com.au. 900 IN NS ns1.webcity.com.au. >md9i9voubqb55nj87e5v632qbmvr5iou.com.au. 900 IN NSEC3 1 1 1 D399EAAB >MEFD6Q0ERABMQN2RAB50F1HH09I97LQJ NS SOA RRSIG DNSKEY NSEC3PARAM >md9i9voubqb55nj87e5v632qbmvr5iou.com.au. 900 IN RRSIG NSEC3 8 3 900 >20200510112409 20200419102409 14968 com.au. >NaPYDJ8CRTqEZjbg0P0TixYilktxYIGAbaXtJfHDo6U1CKDVGM60xaxh >ZR3r6HNm97DPDu6b2JBjDZorrii11Xnzh9BHLRQ9dUF8kTc4af2oXzlV >Kdlro5syJi/KwSGhbt1RggHA4VkO3wKFtrfjDOmiLJIMQWHwkqBQ4NAm oQ4= >vaqgmmki023nor48ihks806ma31inome.com.au. 900 IN NSEC3 1 1 1 D399EAAB >VCD6O7SJS6DAC2HHRGC5KSV3IF445P3H NS DS RRSIG >vaqgmmki023nor48ihks806ma31inome.com.au. 900 IN RRSIG NSEC3 8 3 900 >20200509003832 20200417233832 14968 com.au. >RHXFSR+P5JjZwnuqw4/qoBY2VNe6RCsuh46FHE5rBLwiroF92/bPd18w >8CbpolbV/RD24qmerrbULMIwqGUCMK3gtq3XiwVchovxwAimbxLgEyB8 >PnziuUuMF2efxV1pW2Mz1quC5v18GiGWMoavAsXO+mdySr3q+PITMuq0 vKI= >;; Received 660 bytes from 65.22.197.1#53(r.au) in 20 ms > >trubuiltpambula.com.au. 10800 IN A 203.39.65.64 >trubuiltpambula.com.au. 43200 IN NS ns1.instanthosting.com.au. >trubuiltpambula.com.au. 43200 IN NS ns2.instanthosting.com.au. >;; Received 118 bytes from 203.17.36.4#53(ns2.webcity.com.au) in 292 ms Best wishes, Matthew ------ >From: Karl Auer <ka...@biplane.com.au> >To: "bind-users@lists.isc.org" <bind-users@lists.isc.org> >Cc: >Date: Sun, 19 Apr 2020 20:52:30 +1000 >Subject: oddity with trubuiltpambula.com.au >In the "Nameservers" section of the DNS management interface at a >hosting provider (webcity.com.au), we see three nameservers for the >above domain: > >ns1.webcity.com.au (203.17.36.33) >ns2.webcity.com.au (203.17.36.4) >ns3.webcity.com.au (116.0.23.249) > >However, when we query the DNS for the nameservers for this domain, we >get different answers: > >kauer@kt:~$ dig +short trubuiltpambula.com.au ns >ns1.instanthosting.com.au. >ns2.instanthosting.com.au. > >The two instanthosting nameservers returned have the same IP addresses >as ns1.webcity.com.au and ns2.webcity.com.au. And for completeness we >checked and there is also an instanthosting A record pointing to the >same IP as ns3.webcity.com.au: > >kauer@kt:~$ dig +short ns3.instanthosting.com.au >116.0.23.249 > >We also get the two instanthosting nameserver names when we query any >of those webcity nameservers directly. For example: > >kauer@kt:~$ dig +short trubuiltpambula.com.au ns @ns1.webcity.com.au >ns1.instanthosting.com.au. >ns2.instanthosting.com.au. > >A trace shows an additional lookup occurring between the website >nameservers and the instanthosting nameservers being returned. > >kauer@kt:~$ dig +trace trubuiltpambula.com.au ns >[...] >trubuiltpambula.com.au. 900 IN NS ns1.webcity.com.au. >trubuiltpambula.com.au. 900 IN NS ns2.webcity.com.au. >trubuiltpambula.com.au. 900 IN NS ns3.webcity.com.au. >[...] >;; Received 660 bytes from 65.22.197.1#53(r.au) in 51 ms >[...] >trubuiltpambula.com.au. 43200 IN NS ns2.instanthosting.com.au. >trubuiltpambula.com.au. 43200 IN NS ns1.instanthosting.com.au. >;; Received 102 bytes from 203.17.36.4#53(ns2.webcity.com.au) in 30 ms > >Is there a good explanation for what's happening? > >Yours mystifiedly, K. _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
