What if the results of local DNS resolution and public DNS resolution are different?

　　When you enter a URL and the page either won't load or redirects to a random ad page, but works perfectly fine using mobile data—this is most likely a DNS resolution problem. The most direct sign is that the IP address retrieved using your local DNS is completely different from the one retrieved using public DNS. This inconsistency doesn't necessarily mean DNS poisoning; it could be due to an old cache, static bindings in the hosts file, or a CDN returning different nodes. This article breaks down the causes of discrepancies and methods for identifying DNS poisoning. By following the steps, you can determine if your DNS is poisoned.

　　Step 1: Understand What Kind of Difference is "Different"

　　Don't jump to the conclusion that your DNS is poisoned just because you find two mismatched DNS results. Search results show at least five common reasons that can lead to inconsistent resolution results.

　　1. Local DNS Cache Not Updated

　　Operating systems, browsers, and routers all cache DNS records, and these caches adhere to Time-To-Live (TTL) expiration. 1. After you change the DNS resolution settings, your local cache might still be using the old IP address, but the public DNS is fetching the latest authoritative resolution results in real time, so the two will naturally not match. This is the most common reason.

　　2. The hosts file or router configuration has been tampered with.

　　If your computer's hosts file contains a static IP binding for a domain, it will bypass the normal DNS resolution process, causing the local resolution results to be completely distorted and will definitely differ from the standard results from the public DNS.

　　3. CDN scheduling returns different nodes.

　　If your domain uses a CDN, when accessing the same domain, the CDN will automatically assign different edge nodes based on the client's network. The browser might connect to the nearest CDN node, while nslookup might find a node in a different region. The IPs are different, but it's perfectly normal and has nothing to do with DNS pollution.

　　4. The ISP's DNS uses intelligent traffic splitting.

　　Some ISPs cache old domain records, perform intelligent traffic splitting, and even slightly hijack DNS resolution. Public DNS strictly synchronizes with authoritative server data, so the results will naturally differ.

　　5. Browser with DoH Encrypted DNS Enabled

　　Modern browsers like Chrome and Firefox enable DoH by default, bypassing system DNS settings and using the browser's built-in encrypted DNS service. This means nslookup uses the system DNS, while the browser actually uses DoH, potentially resulting in completely different resolution results.

　　Step Two: Regain Control – Compare Results Only from the "Same Pipeline"

　　To avoid interference from the above factors, a clean comparison should be performed – using the same tools and methods, query the same domain name through both local DNS and public DNS.

　　Using nslookup (compatible with Windows/Linux/macOS)

　　First, check the results from the local DNS:

nslookup example.com

　　Note the returned IP address.

　　Then, query the public DNS server again:

nslookup example.com 8.8.8.8

　　Alternatively, use domestic roaming services like 114.114.114.114

　　Use dig (Linux/macOS)

　　Local query:

dig example.com +short

　　Specify public DNS lookup:

dig @8.8.8.8 example.com +short

　　Search results show that if the two returned IP addresses differ significantly, and the website can be accessed normally after changing the public DNS, DNS poisoning is highly likely.

　　Step 3: Three Core Indicators for Judging Poisoning

　　After obtaining the two IPs, use the following three criteria to judge:

　　1. Is the IP returned by the local DNS obviously fake?

　　If the local DNS resolution result is 127.0.0.1 (local loopback address), 192.168.x.x (LAN address), or a strange IP you don't recognize, while the public DNS returns a normal address, then it can be basically confirmed as poisoning.

　　2. Are the results of repeated queries stable?

　　Use nslookup to repeatedly query the same domain name several times. If it's poisoning, the returned fake IP may change each time, or it may always point to an invalid address. For a normal domain, the authoritative record should be consistent regardless of how many times it's queried.

　　3. Verify connectivity with ping

　　Ping the IP returned by the local DNS. If ping requests time out or the packet loss rate is extremely high, but the website can be accessed normally under other network conditions, it indicates that the locally resolved IP address may be a poisoned spoofed address.

　　Step 4: Eliminate "False Positives"—Check the Cache and Hosts Files First

　　Before confirming poisoning, eliminate the two interfering factors: caching and configuration anomalies.

　　Clear the local DNS cache

　　Windows：

ipconfig /flushdns

　　macOS：

sudo killall -HUP mDNSResponder

　　Linux (depending on system services):

sudo systemd-resolve --flush-caches

　　After clearing the cache, run `nslookup` again for comparison.

　　Check the hosts file:

　　Windows path: C:\Windows\System32\drivers\etc\hosts

　　Linux/macOS path: /etc/hosts

　　If the file contains a static IP binding for the target domain, delete that line and try again.

　　Step 5: Multi-node cross-validation – Locating the scope of pollution

　　Comparing only the results from the local DNS and a single public DNS is insufficient. It is recommended to use multiple public DNS servers for cross-validation to pinpoint where the pollution is occurring.

　　You can query the same domain name sequentially using these public DNS servers and compare the results.

　　If all public DNS servers return the same IP address, except the local default DNS, the pollution occurs at the local network level (ISP DNS has been tampered with or hijacked).

　　If multiple public DNS servers return different IP addresses, it's more likely that CDN scheduling is normal, and it's not pollution.

　　Summary of processing flow:

　　Step 1: Use `nslookup` to query the same domain name through both the local DNS and public DNS servers to obtain two IP addresses.

　　Step 2: Check if the IP addresses returned by your local DNS are obviously abnormal (e.g., 127.0.0.1, 192.168.x.x, completely unreachable IPs).

　　Step 3: Clear your local DNS cache and check your hosts file to rule out caching and static configuration interference.

　　Step 4: Perform cross-validation using multiple public DNS servers to determine whether the pollution is occurring at the local or network level.

　　Step 5: If pollution is confirmed, switch your local DNS server to a public DNS server and clear the cache.

　　Step 6: If the pollution persists (especially on a corporate network or at the ISP level), consider enabling DoH encrypted DNS to bypass the ISP's default DNS resolution.

　　"Different resolution results" isn't necessarily a disaster, but to understand the cause, you need to break it down step by step—first rule out caching and configuration interference, then perform cross-comparison using multiple public DNS servers. Following this process will allow you to determine whether it's DNS pollution or a normal phenomenon.