1

When I open cmd.exe and do nslookup on google.com I am getting a set of addresses that belong to my ISP.

More than that, even when I try to run server 8.8.8.8 or server 8.8.4.4 and query for google.com I still get the same addresses.

When I use some external web page to do the DNS resolve such as http://www.kloth.net/services/nslookup.php for example, with 8.8.8.8 - google.com resolves to addresses that belong to google.

I talked to my ISP and they claim that it not their doing and that this is what the google server is returning... and that something similar is happening with some other ISP in our country (only the addresses returned are for that ISP).

Because resolving google.com via 8.8.8.8 also returned the same ISP addresses I though that maybe they are hijacking all the port 53 (DNS) trafic to their DNS, but when I tried to use some other public DNS I found on the internet (93.107.99.49) it returned addresses that belong to google.

Is it possible/reasonable that my ISP is right and google are resolving google.com to addresses on my ISP and why?

What can I further do to test this?

Improve this question
4
  • 5
    Google may have equipment hosted by your ISP to shorten latency for some of the popular requests. Can you connect using TLS (HTTPS) to google services and get a valid certificate?
    – Z.T.
    Commented Aug 20, 2015 at 13:54
  • I have observed this behavior, with addresses such as xxxxx-google.(citystate).verizon.com on FiOS. One can only assume Google has colo deals with ISPs to provide better service, ostensibly for youtube. Not an answer since that's as far as my knowledge goes there.
    – Arthur Kay
    Commented Aug 20, 2015 at 20:14
  • but if that was the case - how does it help to resolve google.com to those servers? (and not any *.google.com) and why would my ISP claim to know nothing about this?
    – epeleg
    Commented Aug 21, 2015 at 13:11
  • Same "problem" here from three different locations and three different ISPs: Rogers, Cogeco, and Bell in Canada. The ISP nameserver as well as OpenDNS and Google resolvers all return the colo-ed (?) addresses, but other random public nameservers return the "correct" IP, so that rules out DNS hijacking.
    – Raman
    Commented Oct 28, 2015 at 6:08

0

Reset to default

Browse other questions tagged .