Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Two people on the same office. One uses WIFI on a broadband network and the other one uses Tele2 3G (Sweden), both from a Macbook Pro. When they try to open www.good-morning.se on their browser, the one with Tele2 3G gets no reply.

Running ping www.good-morning.se on Tele2 3G returns unable to resolve host name

cat /etc/resolv.conf contains:

nameserver 130.244.127.161
nameserver 130.244.127.169

I tried to use nslookup with the following commands - and my limited knowledge - to check if they were able to resolve www.good-morning.se, and got the following:

set type=any               
good-morning.se
Server:        130.244.127.161
Address:    130.244.127.161#53

Non-authoritative answer:
good-morning.se    rdata_46 = DS 5 2 3600 20120115105933 20120101070740 46408 se. VB0I99aXXfvlQCUFlz2ZyYSl0NAP9GFmtbXDDUazvJHDl9GhLbjxFcIc 9iwt76UbNcEcdrmKa5aG/IbyHByTTXhFekfTfEIHiwpGrym/Gy2Lfnsa ey07TI76swoj3uqVLURr0XA7ZTg9GDD5AiKhZiwmEqtKRgLkb+Lw+9Et XWY=
good-morning.se    rdata_43 = 0 3 1 6EC93D9FE658A93BB8481021B7445370F0669895

Authoritative answers can be found from:
se    nameserver = g.ns.se.
se    nameserver = f.ns.se.
se    nameserver = d.ns.se.
se    nameserver = c.ns.se.
se    nameserver = h.ns.se.
se    nameserver = j.ns.se.
se    nameserver = b.ns.se.
se    nameserver = e.ns.se.
se    nameserver = i.ns.se.
se    nameserver = a.ns.se.
a.ns.se    internet address = 192.36.144.107
a.ns.se    has AAAA address 2a01:3f0:0:301::53
b.ns.se    internet address = 192.36.133.107
c.ns.se    internet address = 192.36.135.107
d.ns.se    internet address = 81.228.8.16
e.ns.se    internet address = 81.228.10.57

Are you able to shed some light on my problem?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

The problem your seeing is due to incorrect DNSSEC configuration made by Crystone ( The registrar and nameserver operator of the good-morning.se domain )

Most big ISPs in Sweden are doing DNSSEC valdation.

The problem is that there is a DS record in the parent zone ( .se ) but no DNSKEY in the child zone ( good-morning.se ).

One way to resolve this is to contact the owner,nameserver operator or registrar and tell them that the domain is broken.

Here are some useful links :

http://dnscheck.iis.se/?time=1325749871&id=2103531&test=standard&view=basic&setLanguage=en

http://en.wikipedia.org/wiki/DNSSEC

Hope this was helpful.

share|improve this answer
    
Wow! That's specific, Michael. Thanks. I will push this forward to the registrar and the domain owner, and then publish the results here. –  nitech Jan 6 '12 at 8:40
    
Finally managed to move site to my registrar. Looks like your tool says most is OK now: dnscheck.iis.se/… –  nitech Feb 10 '12 at 15:09
add comment

Looking at the answer, it looks like either you asked a non-recursive query. Or the name server does not do recursive queries. Both cases would be strange.

What is a recursive query? When you ask for www.good-morning.se, then your browser must ask the name server of the domain good-morning.se for the address of the host www.good-morning.se. However, to know the name of the name server for good-morning.se domain, it must ask the name server for .se domain what is the name server for good-morning.se domain. A recursive query goes through all these levels in one go (you ask the server to just do all the work and give you the final answer). Non-recursive query does just one level at a time. The answer from your post contains addresses for name servers for .se domain, so it looks like either the question was not recursive, or the server didn't do all the fetching it ought. I have no idea why either of these could happen.

You could use e.g. wireshark or tcpdump to see what kind of query is being sent, then you either have to figure out what is wrong and either correct configuration on your side or have a chat with support of your ISP.

PS More on recursive and non-recursive queries see e.g. here or use Microsoft.

share|improve this answer
    
Thanks Pawel. I guess I did not ask a recursive query when I did nslookup, but the OS should do so automatically when trying to get the IP-address for good-morning.se, shouldn't it? –  nitech Jan 3 '12 at 12:20
    
You are welcome. For the nslookup the default is to ask recursive queries (at least according to the man page on Linux). Also the OS should ask recursive queries, so I do not know, what is actually happening. To be really sure I would take a look at what is being sent on the wire, to really know how does the query look like before starting to either troubleshoot problem on the local machine or to pester ISP support. –  Paweł Brodacki Jan 3 '12 at 12:30
    
We did a test on the two computers, and it turns out that when they are connected to the Tele2 3g connection, none of them get to good-morning.se, and when they are connected to DSL, both of them work. I guess it is safe to assume that the problem is with the Tele2 DNS server? Strange though, cause I have never experienced a problem like this before. –  nitech Jan 4 '12 at 12:50
    
Either that, or the software responsible for the 3g connection does something incorrectly. Anyhow, if it's Tele2 3g, then Tele2 should be able to help you either way. –  Paweł Brodacki Jan 4 '12 at 12:55
    
Yeah, I will check up on them. You know how we tend to think that there is probably a problem somewhere else (and not on my laptop) - so not walking into that trap again, I wanted to check out possible local problems before implying that their DNS is faulty. Tele2 is a big ISP, so they should know what they are doing. I'll post updates. –  nitech Jan 4 '12 at 12:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.