Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a client we host a web for ( We do not manage's DNS setup, we just told them to point to our web server's IP.

We have noticed that sometimes we cannot browse to, but we can browse to other sites on that server.

Troubleshooting a bit using host(1) yields something funny:

$ host
Using domain server:
Host not found: 3(NXDOMAIN)

, being one of Google's public DNS servers. However, sometimes the same server resolves the name correctly (!).

Another funny thing, is that our ISP's DNS servers sometimes say:

$ host

Using domain server:
Aliases: has address x.x.x.x
Host not found: 3(NXDOMAIN)

Which I don't really understand. I've dug around using dig(1), and have noticed they've set up a SOA record for

$ dig

; <<>> DiG 9.7.0-P1 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59824
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;         IN   A

;; AUTHORITY SECTION:      86400   IN   SOA 2011030301 86400 7200 2592000 172800

;; Query time: 78 msec
;; WHEN: Thu Mar  3 16:16:19 2011
;; MSG SIZE  rcvd: 78

... which I'm completely unfamiliar with.


We can't really do much as we do not control DNS, but we'd like to point our clients in the right direction...

share|improve this question
up vote 2 down vote accepted

The first entry in the SOA record should be one of the DNS servers hosting the zone (these are called the "authoritative servers", which are the devices actually serving the information; they may their own systems or they may be an ISP or registrar); in this case, it's - does this match what's provided in the WHOIS entry for the domain?

Another thing to check is dig -t NS; this should point to the DNS servers that are hosting the zone as well. Preform the same lookups against those servers, and make sure they return the same information.

In other words, the Nameservers in the WHOIS entry should point to the exact same place as the "NS" records, and the first name in the SOA record should be pointing to one of those servers as well.

Issues with these pointers could cause the type of transitive resolution issues that you are seeing.

Edit: There are a number of online tools available that you can point at a domain name and will run some or all of these checks automatically, warning you about anything that's inconsistent.

share|improve this answer
Well; I've tried and it points out a lot of issues, which I've forwarded to the appropiate party for consideration. I've run dig -t NS, dig -t NS x.x.x.x, where x.x.x.x are the NSs listed in the first query. They all return the same, except a "SOA authority section", which is not present in our ISP's DNS response, but is present on their nameservers. – alex Mar 3 '11 at 16:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.