Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I asked our domain registrar to configure the name servers for a new domain. They said it was done so I checked:

dig NS

Using Google's servers, this is what I get:

dig NS

; <<>> DiG 9.7.1-P2 <<>> NS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 27910
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;           IN  NS

;; Query time: 244 msec

In other words, there is no answer. So I figure they did not yet the nameservers. Asked again and they now came with their proof:

dig @local-isp-ns NS

; <<>> DiG 9.4.1-P1 <<>> @local-isp-ns
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53790
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0
;; WARNING: recursion requested but not available


;; AUTHORITY SECTION: 86400 IN NS our-name-servers. 86400 IN NS our-name-servers.

;; Query time: 1 msec

In other words, they query a local ISPs NS, and all of a sudden it DOES get an answer. I repeated this exercise and the NS indeed show up at certain servers but not at others (including Google DNS). This change was supposed to be done weeks ago so syncing is not an issue. I just want to understand what is going on. A fact is that the has NOT yet been configured on our nameservers. So could it be that the NS answer on some nameservers comes back blank, because it sees that the nameservers that were specified are not in fact functioning? Or is something else going on?


share|improve this question
Can you give us the domain name you are trying to get working? It makes it much easier for us if you can. – Sam Jan 25 '11 at 22:51
Can you give the SOA RR so we can see the cache times? – Mark Wagner Jan 25 '11 at 23:35
@Sam: I can not provide the domain as this belongs to a client and I should not divulge this as of yet. – user60129 Jan 26 '11 at 0:02
@Embobo: SOA records added. – user60129 Jan 26 '11 at 0:03
The domain would help a lot to be honest do you mind providing it now? – Jacob Jan 28 '11 at 23:39
up vote 1 down vote accepted

Try it with trace on. It will trace your request from the root servers down to your NS.
dig +trace NS

Secondly, can you whois your domain and check which nameservers it points to? Then you can try
to verify.

share|improve this answer

Remember that caching will greatly affect the results. If you had queried google's name servers, for example, right before the real zones went live it would have resulted in the "negative answer" being cached by google. Then when it went live and you queried google again, it would have used the cached answer rather than querying the upstream server again.

In time, everything will flush out. But you need to wait till the negative caching timeout for the parent zone to pass.

share|improve this answer
Agreed, but as mentioned this change was supposedly done weeks ago, so caching should not be a problem. I do suspect them of having made this change in fact last-minute, but want to make sure that what happened is not possible except for caching result changes. – user60129 Jan 26 '11 at 0:01 - global DNS checker, look for your NS records there and see if anyone has them. – troyengel Jan 26 '11 at 0:52
Also, I should mention: don't trust google's DNS :-P They're already known for deliberately breaking things. You might try some of the other public ones, like comcast's DNSSEC enabled one. – Wes Hardaker Jan 26 '11 at 16:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.