Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Mac mini server i want to setup to host a couple of things.

My setup is as follows:

The WAN connection (static IP and ISP nameservers) goes into the wan port of the Airport Extreme. The Mac mini server is connected to one of the ethernet ports. The mac mini will host my domain

My settings so far: Airport Express gets:

96.x.x.x as the external static IP from the ISP

174.y.y.y as the nameserver

Mac mini server always gets a reserved DHCP IP from the Airport Express: is the server's ip as the dns (this ip is the airport express itself)

My dns server has an A record pointing to and a PTR doing the reverse.

I've already added my 96.x.x.x to point with my registrar as attached.

NOW: Nobody seems to be able to access my to resolve any of my records. From a any computer in my network I CAN see my ns and everything works. The outside on the other hand does not... it's as if the airport extreme which "holds" the exterior 94.x.x.x address doesn't pass DNS along to my ns server.

I have the server managing the airport. Isn't this supposed to work?

share|improve this question
Any particular reason why you'd like to host DNS yourself? –  Jack Lawrence Jan 2 '11 at 0:51
Also, what do you mean by this: "174.y.y.y as the nameserver" what nameserver is this? –  Jack Lawrence Jan 2 '11 at 2:32

2 Answers 2

up vote 1 down vote accepted

Edit: Okay... it looks like your top level domain provider hasn't properly pointed to 96.x.x.x. My computer attempts to resolve, recognizes that you've set up the nameserver to be, but then it is unable to resolve what IP address (the 96.x.x.x address) it should look to. When did you have your domain provider set up the pointer? If it was within the last day, it needs time to replicate around the world. Since I'm unable to get the IP address of at all, it is not a router issue. If it were a router issue I would be able to find out the 96.x.x.x address but a traceroute would fail at the router. alt text

Check this link out: It uses a bunch of fancy confusing language but basically what you're missing is that glue record.

To break the query deadlock for referrals which return name servers within the domain being queried. Assume a query for a domain, say the A RR for, returns a referral containing the name but not the IP address of a name server, say, which lies within the domain Since the IP address of the name server is not known this will naturally result in a query for the A RR of which will return, again, a referral with the name but not the IP of! When the glue record is provided this problem does not occur.

alt text

As you can see from the diagram, there's an infinite loop going 2->3->4->5->4->5->4->5->4

Just a quick thought: It's possible you may also need a reverse record, sometimes called a PTR record. You can ask your ISP to set that up. You'll want a reverse record pointing 96.x.x.x to and

A side note: it is highly inadvisable to host public DNS on a single server in a single location with non-redundant power and internet and routers and a consumer-grade connection.

Also, from outside of the network, run traceroute -p X where X is a port number DNS uses, for each port number DNS is using. This will tell you the path that computers outside of the network are taking to attempt to get to your server.

share|improve this answer
I'm using an Airport Extreme. Could the ISP somehow block DNS to my location? –  unmircea Jan 1 '11 at 23:00
It's possible. From outside of your network, can you resolve the ip address associated with Is it correct? It should be the 96.x.x.x address. (run ping in the terminal and see what IP address is attempts to ping). Again, try tracerouting the ports to see if your ISP is blocking them. –  Jack Lawrence Jan 2 '11 at 0:04
Ok, you said "my computer recognizes that you've set up the nameserver to be" how are you able to infer that? What i've set up with the provider is a "child nameserver" with and my IP. It turns green and tells me it's created. Then I added to the nameserves list for (i used to have a doteasy dns there). Now that child nameserver turns from green to grey and says it's "attached to the parent domain". The page is very simple, there are no other settings to speak of, and i have done this before. 20 h since my last update. –  unmircea Jan 2 '11 at 0:51
I'm beginning to think it's the ISP. I have a nearly complete mental model on these issues. The thing i'm missing MUST be related to something else. –  unmircea Jan 2 '11 at 0:58
Again, at this point my computer isn't even attempting to connect to you. At this point, it's still asking what the IP address is for so that it can then attempt to connect. –  Jack Lawrence Jan 2 '11 at 1:01

Firstly, "" resolves to a webpage that works ok for me so I am guessing that it's not your real domain name. Knowing the real domain name would help us help you so much faster.

Secondly, this sounds like you're doing this from home without the support of your ISP? They could well be blocking DNS servers running to domestic networks, as there is very few legitimate reasons why this would be needed by most customers.

Next, have you actually registered this domain, and got authoritative DNS entries for your domain pointing towards the external internet address of your router?

It isn't enough just to put a DNS server online, type in a domain name that you fancy and say "here we are, world, come and get us" and from the way your question is phrased it sounds a bit like this is what you've done.

share|improve this answer
Totally agree with you. –  Jack Lawrence Jan 2 '11 at 0:04
I'd also like to know the real domain name; in a few seconds I or Robert Moir could diagnose the issue. –  Jack Lawrence Jan 2 '11 at 0:10
The domain is "" to the direct A record "" –  unmircea Jan 2 '11 at 0:12
I have configured with my top level domain provider for the 96.x.x.x to point to my –  unmircea Jan 2 '11 at 0:21
see my edits :) –  Jack Lawrence Jan 2 '11 at 0:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.