3

I have two domains pointing at the same IP address with A records. Both domains use the same two nameservers, and still I am having big connection issues for many, but not all of the customers coming to the site. IntoDNS reports that the nameservers do not agree on a SOA serial, but this only happens for one of the domains.

So some testing later I found that Google public DNS servers don't even respond to ping from the domain that doesn't work, but other public DNS servers do, and they serve the web page as well. I have tested 4.2.2.1, 4.2.2.2 and 208.67.222.222, all public DNS servers. When visiting the web site it throws an error:

ERR_NAME_NOT_RESOLVED

Does anyone have any idea what this could mean? The nameservers serials fail on one domain and not the other while they both point to the same address? And that google DNS does not index it while others do?

I think I have passed the update time limit as it has been like this for over a week.

dig results from google DNS:

; <<>> DiG 9.8.5-P1 <<>> @8.8.8.8 woolland.se
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 44011
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;woolland.se.           IN  A

;; Query time: 97 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 14 12:39:15 BST 2013
;; MSG SIZE  rcvd: 29

dig results from 4.2.2.1:

; <<>> DiG 9.8.5-P1 <<>> @4.2.2.1 woolland.se
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62739
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;woolland.se.           IN  A

;; ANSWER SECTION:
woolland.se.        3253    IN  A   91.207.159.238

;; Query time: 46 msec
;; SERVER: 4.2.2.1#53(4.2.2.1)
;; WHEN: Sat Sep 14 12:40:27 BST 2013
;; MSG SIZE  rcvd: 45
masegaloeh
  • 18,236
  • 10
  • 57
  • 106
Alex
  • 131
  • 1
  • 4
  • What are the connection issues, exactly? It would help if you gave a little more detail on the symptoms. – Falcon Momot Sep 14 '13 at 12:32
  • Good idea, I amended the error that the web browser receives. Thanks – Alex Sep 14 '13 at 18:40
  • 1
    Yeah, what happens is consistent with my answer. Google enabled DNSSEC relatively recently (may?), and newer installs of BIND among other things will validate and SERVFAIL on failures. – Falcon Momot Sep 14 '13 at 21:40
  • All right yes that seems to be the issue. My server provider just aknowledged issues with the nameservers they had. Thanks. – Alex Sep 15 '13 at 14:51

1 Answers1

3

I suspect, without you mentioning it, that the connection issues might indeed be caused by DNS resolution problems.

I am not sure why it is exactly that 8.8.8.8 behaves in the way that it does when resolving your name, but you may find some interesting results when you investigate DNSSEC problems.

First, let's do a trace (I'll remove lots of stuff for brevity):

$ dig +trace @8.8.8.8 in a woolland.se
<snip>
woolland.se.            86400   IN      NS      ns1.uniweb.no.
woolland.se.            86400   IN      NS      ns3.uniweb.no.
woolland.se.            3600    IN      DS      47206 8 1 0F680594167E22758CED534A22CC6B0DF7092BB9
woolland.se.            3600    IN      DS      47206 8 2 ED352517E9D3A24071F3E5183E2A0EC200A28E328089E1C9659A382B D5FBC616
woolland.se.            3600    IN      RRSIG   DS 5 2 3600 20130924164158 20130911081201 6388 se. accBgRdJlBn18VVNysPhBmmVBsMeiLC58cMg9kVYUTYqg4iLtPmPKH/X FD6HqR8rWFzXvUIMs11SHl2ImJL9MOC0ggWMz4Lc/CcrfYveHEolJ9BX 9b5tImUlJrp6t7A4+U9oW354aJDfhdd8cEJmUNDZUq1LbmfoGolF588g Y9g=
;; Received 331 bytes from 2001:67c:254c:301::53#53(2001:67c:254c:301::53) in 214 ms

woolland.se.            3600    IN      A       91.207.159.238
;; Received 45 bytes from 109.247.131.38#53(109.247.131.38) in 190 ms

You may notice that at the end of recursion, we don't get an RRSIG for your zone. However, it happens that we do get a DS record (delegation of signing) from the .se TLD servers:

$ dig @j.ns.se in ds woolland.se
<snip>
;; QUESTION SECTION:
;woolland.se.                   IN      DS

;; ANSWER SECTION:
woolland.se.            3600    IN      DS      47206 8 1 0F680594167E22758CED534A22CC6B0DF7092BB9
woolland.se.            3600    IN      DS      47206 8 2 ED352517E9D3A24071F3E5183E2A0EC200A28E328089E1C9659A382B D5FBC616

The presence of the DS record indicates that your zone is signed, but it isn't.

What you must do is either get the DS record out of the .se root somehow, or update it and set up DNSSEC on your domain.

Level3's DNS servers are not (yet?) fully set up to do DNSSEC; you may notice that even if you set AD and unset CD on your queries to them, you will never get a reply with the AD flag back. Similarly, google's DNS server 8.8.8.8 does fully support DNSSEC, and so queries for your domain with the CD flag set will give your address (this flag stands for "checking disabled"):

$ dig @8.8.8.8 +cdflag in a woolland.se

; <<>> DiG 9.9.2-P2 <<>> @8.8.8.8 +cdflag in a woolland.se
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53877
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;woolland.se.                   IN      A

;; ANSWER SECTION:
woolland.se.            3471    IN      A       91.207.159.238

;; Query time: 46 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 14 08:02:31 2013
;; MSG SIZE  rcvd: 56

The differing serial has nothing at all to do with this, though it does indicate that your two DNS servers may be out of sync. Check that they are replicating properly; if the serial on the master is lower than that on the slave, bump the one on the master up to a higher value than both.

Falcon Momot
  • 25,244
  • 15
  • 63
  • 92