Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up the nameserver for my VPS service using bind9. My server has Ubuntu 10.04LTS setup.

The problem that I am facing is that, for some people, they cannot connect to my server at all. I think it has to do something with DNS settings.

To test that problem, I did the following test. Lets say my server as server A (nameserver).

From random server B, if I dig to one of domain hosted on my server A it always finds returns the 'NoError' result. (which means successful)

However, for random server C, if I dig to one of domain hosted on my server, about half of the time, it returns SERVFAIL result and the other half 'NoError'. This is really really weird, because how can dig fail while it was successful like few seconds ago?

One of domains using my nameserver (bind) is like below.

$TTL    604800
@       IN      SOA (
                        20110120        ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS
@       IN      A
ns      IN      A
www     IN      A

Is there anything exceptional that may cause problem? Some people say TTL 604800 is just too long.. is it?

share|improve this question
up vote 3 down vote accepted

First off, if you've recently changed the name servers for a domain, then propagation is a likely cause. In any event, the tests below should help determine things are configured correctly.

Test 1: Determine your DNS servers configured for your domain. Run and note the results of the following commands:

$ whois - Shows what the WHOIS record has listed as your name servers (yes, this can be done from the command line for most *nix systems)

$ dig +trace ns - Cross-reference the NS listed on the WHOIS with what the DNS servers say (the +trace gives detailed view of the servers that are hit while doing your query and the 'ns' queries the NS record for the domain). You, ideally, want to run this on both Server B & Server C and compare results

$ dig +trace - Just for good measure, see what the dig query says for just the domain itself. Again, do this test on both machines.

NOTE: I believe this is where you'll likely see a failure. It sounds like one of your name servers is not responding for some reason. This may be due to one of your DNS servers incorrectly setup or propagation.

Test 2: Query directly against your name servers to ensure they're both setup correctly

Ideally, you should have two name servers configured for your domain hosted on two separate machines. Many people don't do this (I'm assuming it's not a big deal if their domain doesn't resolve if their name server happens to go down). We will query against both name servers to ensure the correct IP addresses are being returned. Do this using the following:

$ dig - Replace '' with your DNS server's IP address or hostname (IP address for better measure).

Likewise, test the second name server and ensure it's giving the correct values:

$ dig - Again, replace '' with your DNS server's IP address or hostname (IP address for better measure).

These tests should show any anomalies in the configuration or in the DNS resolution process from either machine.

Hope that helps. Please post results if you're still having issues.

share|improve this answer
If I add +trace option when I dig it seems that both server B and C always find the result correctly. It seems that this problem is happening since I only have 1 nameserver, and do not have secondary nameserver. I read somewhere that 1 nameserver for domain can be over-ridden. I will post more comments if using 2 nameservers solves the problem. – user80091 Jun 20 '11 at 5:46
Apparently, after I set two nameservers, it seems that the site is now connectable from every user. But I still want to know how registrar can over ride the setting if there is only 1 nameserver set for the domain. Thanks!! – user80091 Jun 20 '11 at 22:07
Different registries have different rules. For ICANN (.com/.net/etc) they require you to enter two NS, but won't qualify it. Even if you were to enter two domains pointing to the same IP address, ICANN won't care and will accept the entry. Try that with CIRA (.ca) and they'll refuse to accept two NS with the same IP address. Other registries are even more strict and require the two NS to be on different IP blocks! – uzzi09 Jun 21 '11 at 0:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.