Today i've noticed something strange. When I lookup a domain that does not exist my Linux machine will change the TLD and make it a SLD. After that it will put a regional TLD at the back (my server is located in the netherlands and has a dutch regional IP).domain: nujklfdjaklfjkal.com becomes nujklfdjaklfjkal.com.nldomain: jkfdjaklfjkalfjdkafjdkla.net becomes jkfdjaklfjkalfjdkafjdkla.net.nl[root@example ~]# ping nujklfdjaklfjkal.comPING nujklfdjaklfjkal.com.nl (83.98.157.102) 56(84) bytes of data.64 bytes from www.com.nl (83.98.157.102): icmp_seq=1 ttl=58 time=0.890 ms64 bytes from www.com.nl (83.98.157.102): icmp_seq=2 ttl=58 time=0.741 ms64 bytes from www.com.nl (83.98.157.102): icmp_seq=3 ttl=58 time=0.873 ms^C--- nujklfdjaklfjkal.com.nl ping statistics ---3 packets transmitted, 3 received, 0% packet loss, time 2368msrtt min/avg/max/mdev = 0.741/0.834/0.890/0.074 ms[root@example ~]# ping jkfdjaklfjkalfjdkafjdkla.netPING jkfdjaklfjkalfjdkafjdkla.net.nl (83.98.157.102) 56(84) bytes of data.64 bytes from www.com.nl (83.98.157.102): icmp_seq=1 ttl=58 time=0.973 ms64 bytes from www.com.nl (83.98.157.102): icmp_seq=2 ttl=58 time=0.856 ms64 bytes from www.com.nl (83.98.157.102): icmp_seq=3 ttl=58 time=0.883 ms^CIt seems this is done at the server itself but I havent found what option is doing this. I've scanned the server on exploits, rootkits and malware. None found.Anyone have an idea?Update 1[root@example ~]# cat /etc/resolv.conf; generated by /sbin/dhclient-script#nameserver 80.69.67.66#nameserver 80.69.66.67nameserver 8.8.8.8Update 2[root@example etc]# locate dnsmasq/etc/selinux/targeted/modules/active/modules/dnsmasq.pp/usr/share/augeas/lenses/dist/dnsmasq.aug/usr/share/selinux/devel/include/services/dnsmasq.if/usr/share/selinux/targeted/dnsmasq.pp.bz2/usr/share/vim/vim74/syntax/dnsmasq.vimUpdate 3/etc/sysconfig/network-scripts/ifup-aliases:TEXTDOMAIN=initscripts/etc/sysconfig/network-scripts/ifup-aliases:TEXTDOMAINDIR=/etc/locale/etc/sysconfig/network-scripts/ifup-post:       domain*|search*)/etc/sysconfig/network-scripts/ifup-post:           if [ -n $DOMAIN ]; then/etc/sysconfig/network-scripts/ifup-post:    if [ -n $DOMAIN ]; then/etc/sysconfig/network-scripts/ifup-post:        echo search $DOMAIN $search >> $tr/etc/sysconfig/network-scripts/network-functions:        '(none)' | 'localhost' | 'localhost.localdomain')/etc/sysconfig/network-scripts/network-functions:   domain=$(echo $1 | sed 's/^[^\.]*\.//')/etc/sysconfig/network-scripts/network-functions:   if [ -n $domain ]; then/etc/sysconfig/network-scripts/network-functions:       echo search $domain >> $rsctmpUpdate - August 24thIn my investigation I've made some progress. The hostname of the system was SLD.TLD (example.nl) instead of server.example.nl. It seems, when my server can't find a domain and doesn't have a search configured in /etc/resolv.conf, it will get everything behind the first dot in his own hostname (exampe.nl) and append it to the end of the destination hostname (jkfldajfkdajfklda.com.nl). That way jkfldajfkdajfklda.com becomes jkfldajfkdajfklda.com.nl why my server-hostname is example.nl. However, when I change the server-hostname to server.example.nl, jkfldajfkdajfklda.com suddenly becomes jkfldajfkdajfklda.com.example.nl.The question remains where this logic is configured.
When domain does not exist TLD is changed into a SLD
networking;dns