Why are all my DNS queries received from 127.0.0.1?

I used the host command on Ubuntu 12.04 LTS to check my DNS server:

host -a 

showing this:

Trying ""
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22892
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
; IN ANY
;; ANSWER SECTION: 60 IN SOA ns-942.amazon.com. root.amazon.com. 1405660589 3600 900 7776000 60 7 IN A 72.21.194.212 412 IN NS ns-942.amazon.com.
Received 110 bytes from 127.0.0.1#53 in 176 ms

Why Received form 127.0.0.1?

I've tried different websites, and moved to different locations trying this command. The DNS server shown is always the same: 127.0.0.1. Why?

1 Answer

The IP address 127.0.0.1 means localhost, i.e. it refers to your computer. The DNS response is coming from your computer.

The host program, like all other programs on the system, knows which DNS server to query by looking in the file /etc/resolv.conf.

The reason your computer is sending the DNS response is that it is running a DNS cache. The DNS cache software remembers requests, so that if you access the same site multiple times in quick succession (for example, to display a web page with embedded images, Javascript, frames, etc., or display several pages from the same site), only the first request needs to wait for a reply from a distant server, and subsequent requests get a very quick reply from the local machine.

Ubuntu runs dnsmasq as a DNS cache by default. Dnsmasq itself queries a DNS server provided by your ISP; this configuration is normally done dynamically (through resolvconf: the DNS server is added to the configuration when the corresponding network interface goes up and removed when the interface goes down. Available DNS servers for Dnsmasq are recorded in /etc/resolvconf/run/interface/*.

Note that I provide file names for curiosity purposes only. There are very few circumstances where you would want to edit them.