Some people cannot connect to the domains which my nameserver hosts

Question

I have set up the nameserver for my VPS service using bind9. My server has Ubuntu 10.04LTS setup.

The problem that I am facing is that, for some people, they cannot connect to my server at all. I think it has to do something with DNS settings.

To test that problem, I did the following test. Lets say my server as server A (nameserver).

From random server B, if I dig to one of domain hosted on my server A it always finds returns the 'NoError' result. (which means successful)

However, for random server C, if I dig to one of domain hosted on my server, about half of the time, it returns SERVFAIL result and the other half 'NoError'. This is really really weird, because how can dig fail while it was successful like few seconds ago?

One of domains using my nameserver (bind) is like below.

$TTL    604800
@       IN      SOA     ns.xxxx.net. admin.xxxx.net. (
                        20110120        ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.xxx.net.
@       IN      A       xxx.xxx.xxx.78
ns      IN      A       xxx.xxx.xxx.78
www     IN      A       xxx.xxx.xxx.78

Is there anything exceptional that may cause problem? Some people say TTL 604800 is just too long.. is it?

Answer 1

First off, if you've recently changed the name servers for a domain, then propagation is a likely cause. In any event, the tests below should help determine things are configured correctly.

Test 1: Determine your DNS servers configured for your domain. Run and note the results of the following commands:

$ whois domain.com - Shows what the WHOIS record has listed as your name servers (yes, this can be done from the command line for most *nix systems)

$ dig +trace ns domain.com - Cross-reference the NS listed on the WHOIS with what the DNS servers say (the +trace gives detailed view of the servers that are hit while doing your query and the 'ns' queries the NS record for the domain). You, ideally, want to run this on both Server B & Server C and compare results

$ dig +trace domain.com - Just for good measure, see what the dig query says for just the domain itself. Again, do this test on both machines.

NOTE: I believe this is where you'll likely see a failure. It sounds like one of your name servers is not responding for some reason. This may be due to one of your DNS servers incorrectly setup or propagation.

Test 2: Query directly against your name servers to ensure they're both setup correctly

Ideally, you should have two name servers configured for your domain hosted on two separate machines. Many people don't do this (I'm assuming it's not a big deal if their domain doesn't resolve if their name server happens to go down). We will query against both name servers to ensure the correct IP addresses are being returned. Do this using the following:

$ dig @ns1.domain.com domain.com - Replace 'ns1.domain.com' with your DNS server's IP address or hostname (IP address for better measure).

Likewise, test the second name server and ensure it's giving the correct values:

$ dig @ns2.domain.com - Again, replace 'ns2.domain.com' with your DNS server's IP address or hostname (IP address for better measure).

These tests should show any anomalies in the configuration or in the DNS resolution process from either machine.

Hope that helps. Please post results if you're still having issues.