Using ff 145.0 from mozilla repo.
Some domains resolve to a local ip.
My computer is 192.168.2.3
I have bind on 192.168.2.5 (my local server) running. It resolves OK, both local domain names
> dig mydomain.com.es
; <<>> DiG 9.18.33 <<>> samara.com.es
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14369
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 728013dd07adcb7801000000691d996736715611b8fc49c5 (good)
;; QUESTION SECTION:
;mydomain.com.es. IN A
;; ANSWER SECTION:
mydomain.com.es. 86400 IN A 192.168.2.5
;; Query time: 4 msec
;; SERVER: 192.168.2.5#53(192.168.2.5) (UDP)
;; WHEN: Wed Nov 19 11:18:15 CET 2025
;; MSG SIZE rcvd: 86
and external domain names
> dig google.com
; <<>> DiG 9.18.33 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40397
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 700f08076b39052601000000691d99b3c950382e9e22f3d2 (good)
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 172 IN A 142.250.200.142
;; Query time: 4 msec
;; SERVER: 192.168.2.5#53(192.168.2.5) (UDP)
;; WHEN: Wed Nov 19 11:19:31 CET 2025
;; MSG SIZE rcvd: 83
resolv.conf in my 192.168.2.3 is
search mydomain.com.es
nameserver 192.168.2.5
nameserver 192.168.2.1
mydomain.com.es is really registered and accesible from outside, but resolved locally by bind to access to my server from inside
up to this point all seems OK.
I go in firefox to about:networking#dnslookuptool
and
ok, i can connect to google
form most domain names it return the ip but says HTTPS RRs
NS_ERROR_UNKNOWN_HOST … i don’t know if it is an error or bot, but indeed the browser works and the page is displayed
But for some it returns a local ip… the locla ip of my server and i can’t know why, because the resolver resolves ok and i can’t fian any difference in firefox, here two external domain, one resolves ok, the second resolves to 192.168.2.5
> dig flow.polar.com
; <<>> DiG 9.18.33 <<>> flow.polar.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44979
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ddda4846b4fb1a2201000000691d9c414906002c91bb8fb7 (good)
;; QUESTION SECTION:
;flow.polar.com. IN A
;; ANSWER SECTION:
flow.polar.com. 23 IN A 3.160.237.56
flow.polar.com. 23 IN A 3.160.237.118
flow.polar.com. 23 IN A 3.160.237.42
flow.polar.com. 23 IN A 3.160.237.75
;; Query time: 0 msec
;; SERVER: 192.168.2.5#53(192.168.2.5) (UDP)
;; WHEN: Wed Nov 19 11:30:25 CET 2025
;; MSG SIZE rcvd: 135
in firefox
and this resolv ok, from nslookup but to 192.168.2.5 in firefox
> dig auth.polar.com
; <<>> DiG 9.18.33 <<>> auth.polar.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18393
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 12986ac0dd3033e401000000691d9ca63933e7598ce86552 (good)
;; QUESTION SECTION:
;auth.polar.com. IN A
;; ANSWER SECTION:
auth.polar.com. 60 IN A 18.154.29.13
auth.polar.com. 60 IN A 18.154.29.36
auth.polar.com. 60 IN A 18.154.29.128
auth.polar.com. 60 IN A 18.154.29.70
;; Query time: 60 msec
;; SERVER: 192.168.2.5#53(192.168.2.5) (UDP)
;; WHEN: Wed Nov 19 11:32:06 CET 2025
;; MSG SIZE rcvd: 135
running
tcpdump -i any -n port 53
from y 192.168.2.3 PC and running dns lookup from firefox
dns lookup for flow.polar.com (which resolves ok)
11:39:05.803216 eth0 Out IP 192.168.2.3.49449 > 192.168.2.5.53: 23470+ Type65? flow.polar.com. (32)
11:39:05.803986 eth0 In IP 192.168.2.5.53 > 192.168.2.3.49449: 23470 0/1/0 (116)
dns lookup for auth.polar.com (which resolves to 192.168.2.5)
11:39:17.811936 eth0 Out IP 192.168.2.3.58167 > 192.168.2.5.53: 39775+ Type65? auth.polar.com. (32)
11:39:17.812699 eth0 In IP 192.168.2.5.53 > 192.168.2.3.58167: 39775 0/1/0 (117)
i can’t see the difference, but in the firefox cache
Hostname Family TRR Addresses Expires (Seconds) Isolation Key Extra flags
auth.polar.com ipv4 false 192.168.2.5 648 0|0x2|2|0|
flow.polar.com ipv4 false 3.160.237.118
3.160.237.56
3.160.237.42
3.160.237.75 636 0|0x2|2|0|
why?
Maybe the issue is a bug? I think it has happened before and stop happening.
