Using "System.Net.Dns.GetHostEntry()" to get the IP address for a website, will give different results compared to some online IP checker sites

Question

I am working on a c# console application, and inside my console application, i have the following code, to get the IP for a website:-

using System.Net
using System.Web;
using System.IO;

namespace MyConsoleApp
{
    class Program
    {
      static async Task Main(string[] args)
        {
          IPHostEntry hosten = Dns.GetHostEntry("www." + website);
          if (hosten.AddressList.Count() >= 1)
              {
               string ip = hosten.AddressList[0].ToString();

but the IP i will get for the website will be different compared to the IP i will get from some online IP checker sites such as https://www.site24x7.com/find-ip-address-of-web-site.html.. so is using System.Net.Dns.GetHostEntry() a trusted appraoch to know the IP address for a web site? if the answer is yes then why i am getting different IP from online IP checker sites?

Answer 1

It's very common for websites to have multiple IP addresses. A website could be distributed across multiple places and regions, and the use of multiple IP addresses helps in load balancing and network traffic optimization, among other things. A common technique is to route requests to the closest IP(s) (although active load balancing could prevent it), hence, an online IP checker could produce the IP(s) closer to it.

Why? Because DNS is a hierarchical distributed regional database, Google could have an IP (or more) address(es) in China and that means it'll get registered mainly in that region's DNS servers. Therefore, naive queries for Google's IP coming from China will produce that/those IP(s), while queries from Australia will produce another/other IP(s).

To make things more complicated, Content Delivery Networks like Cloudflare expose an IP of the website which is not its real IP. They do it as part of their DDoS mitigation and overall web security strategies.

All of the above makes it difficult to get a list that contains a complete and universal list of the IP addresses of a particular website. However, if you query the same DNS servers from the same place, you should get a fairly constant list of IP addresses assigned to that host.

Now, regarding your code, when you do:

hosten.AddressList[0]

you're taking only the first IP address in that list, which could be the only IP if that particular host had only one, but could be the first of several resolved IPs of that host. You must check all of the elements of AddressList.

Answer 2

Many websites will have multiple IPs, as they're hosted in multiple places. For further reading check out "Content Delivery Networks"

This is a lot like asking "Why does Pizza Hut have a lot of phone numbers?" Because even though they serve up the same thing, there are a lot of them, and you're going to want to talk to the one closest to you.