Understanding DNS Load Balancing: Why nslookup Returns Multiple IPs for Yahoo/Microsoft (with Configuration Examples)


2 views



When you run nslookup yahoo.com or nslookup microsoft.com, seeing multiple IP addresses is neither an error nor misconfiguration. This is a deliberate DNS technique called "Round Robin DNS" or "DNS Load Balancing". The DNS server intentionally returns multiple A records in rotating order to distribute traffic.



1. Load Distribution
Large-scale services implement this to:
- Spread traffic across multiple servers
- Prevent single-point overload
- Improve geographic response times

2. High Availability
Example configuration from a BIND zone file:

yahoo.com.   300  IN  A  98.137.246.8
yahoo.com.   300  IN  A  98.137.246.7
yahoo.com.   300  IN  A  98.137.246.6




You can test this on a LAN using dnsmasq:


# /etc/dnsmasq.conf
address=/test.local/192.168.1.101
address=/test.local/192.168.1.102
address=/test.local/192.168.1.103


Then query with:

nslookup test.local




When debugging, remember that:
- DNS clients typically use the first IP returned
- Subsequent queries may show rotated order
- TTL values control how long clients cache the response

Example Python code to demonstrate rotation:

import dns.resolver
answers = dns.resolver.resolve('yahoo.com', 'A')
for server in answers:
    print(server.address)




For production environments, consider:
- Weighted DNS responses
- Geo-based DNS resolution
- Anycast routing
- Health-check aware DNS


When you run nslookup yahoo.com or nslookup microsoft.com, you're witnessing DNS load balancing in action. This isn't an error - it's a deliberate configuration technique called DNS round-robin or DNS-based load distribution.

# Example nslookup output for yahoo.com
nslookup yahoo.com
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   yahoo.com
Address: 98.137.11.164
Name:   yahoo.com
Address: 98.137.11.163
Name:   yahoo.com
Address: 74.6.231.21

Major websites implement this for three key reasons:

  • Traffic Distribution: Spreads user requests across multiple servers
  • Geographical Load Balancing: Directs users to nearest datacenters
  • Fault Tolerance: Provides automatic failover if one server fails

You can experiment with this on your LAN using bind9 (Linux) or Windows DNS Server. Here's a basic bind9 configuration snippet:

; Example zone file for round-robin DNS
$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. (
  2023081501 ; serial
  3600       ; refresh
  1800       ; retry
  604800     ; expire
  86400 )    ; minimum

@ IN NS ns1.example.com.
@ IN NS ns2.example.com.

; Multiple A records for the same host
www IN A 192.168.1.10
www IN A 192.168.1.11
www IN A 192.168.1.12

Use dig or nslookup to verify your setup:

dig +short www.example.com
# Should return all configured IPs in rotating order

nslookup www.example.com
# Should show multiple addresses

For production environments, consider these enhancements:

  • Health checks to remove failed servers from rotation
  • GeoDNS for location-based responses
  • Weighted round-robin for uneven traffic distribution

Remember that DNS-based load balancing is just one layer in a comprehensive scaling strategy. Modern implementations often combine it with anycast routing and cloud load balancers.