Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Two people on the same office. One uses WIFI on a broadband network and the other one uses Tele2 3G (Sweden), both from a Macbook Pro. When they try to open on their browser, the one with Tele2 3G gets no reply.

Running ping on Tele2 3G returns unable to resolve host name

cat /etc/resolv.conf contains:


I tried to use nslookup with the following commands - and my limited knowledge - to check if they were able to resolve, and got the following:

set type=any      

Non-authoritative answer:    rdata_46 = DS 5 2 3600 20120115105933 20120101070740 46408 se. VB0I99aXXfvlQCUFlz2ZyYSl0NAP9GFmtbXDDUazvJHDl9GhLbjxFcIc 9iwt76UbNcEcdrmKa5aG/IbyHByTTXhFekfTfEIHiwpGrym/Gy2Lfnsa ey07TI76swoj3uqVLURr0XA7ZTg9GDD5AiKhZiwmEqtKRgLkb+Lw+9Et XWY=    rdata_43 = 0 3 1 6EC93D9FE658A93BB8481021B7445370F0669895

Authoritative answers can be found from:
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =
se    nameserver =    internet address =    has AAAA address 2a01:3f0:0:301::53    internet address =    internet address =    internet address =    internet address =

Are you able to shed some light on my problem?

share|improve this question
up vote 0 down vote accepted

The problem your seeing is due to incorrect DNSSEC configuration made by Crystone ( The registrar and nameserver operator of the domain )

Most big ISPs in Sweden are doing DNSSEC valdation.

The problem is that there is a DS record in the parent zone ( .se ) but no DNSKEY in the child zone ( ).

One way to resolve this is to contact the owner,nameserver operator or registrar and tell them that the domain is broken.

Here are some useful links :

Hope this was helpful.

share|improve this answer
Wow! That's specific, Michael. Thanks. I will push this forward to the registrar and the domain owner, and then publish the results here. – nitech Jan 6 '12 at 8:40
Finally managed to move site to my registrar. Looks like your tool says most is OK now:… – nitech Feb 10 '12 at 15:09

Looking at the answer, it looks like either you asked a non-recursive query. Or the name server does not do recursive queries. Both cases would be strange.

What is a recursive query? When you ask for, then your browser must ask the name server of the domain for the address of the host However, to know the name of the name server for domain, it must ask the name server for .se domain what is the name server for domain. A recursive query goes through all these levels in one go (you ask the server to just do all the work and give you the final answer). Non-recursive query does just one level at a time. The answer from your post contains addresses for name servers for .se domain, so it looks like either the question was not recursive, or the server didn't do all the fetching it ought. I have no idea why either of these could happen.

You could use e.g. wireshark or tcpdump to see what kind of query is being sent, then you either have to figure out what is wrong and either correct configuration on your side or have a chat with support of your ISP.

PS More on recursive and non-recursive queries see e.g. here or use Microsoft.

share|improve this answer
Thanks Pawel. I guess I did not ask a recursive query when I did nslookup, but the OS should do so automatically when trying to get the IP-address for, shouldn't it? – nitech Jan 3 '12 at 12:20
You are welcome. For the nslookup the default is to ask recursive queries (at least according to the man page on Linux). Also the OS should ask recursive queries, so I do not know, what is actually happening. To be really sure I would take a look at what is being sent on the wire, to really know how does the query look like before starting to either troubleshoot problem on the local machine or to pester ISP support. – Paweł Brodacki Jan 3 '12 at 12:30
We did a test on the two computers, and it turns out that when they are connected to the Tele2 3g connection, none of them get to, and when they are connected to DSL, both of them work. I guess it is safe to assume that the problem is with the Tele2 DNS server? Strange though, cause I have never experienced a problem like this before. – nitech Jan 4 '12 at 12:50
Either that, or the software responsible for the 3g connection does something incorrectly. Anyhow, if it's Tele2 3g, then Tele2 should be able to help you either way. – Paweł Brodacki Jan 4 '12 at 12:55
Yeah, I will check up on them. You know how we tend to think that there is probably a problem somewhere else (and not on my laptop) - so not walking into that trap again, I wanted to check out possible local problems before implying that their DNS is faulty. Tele2 is a big ISP, so they should know what they are doing. I'll post updates. – nitech Jan 4 '12 at 12:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.