Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a DNS server, and created a new CNAME, for example, login.server.domain.

If I do a nslookup from within our network, I get back the config (this is a public address) but if I test from outside, I get a "not found" error.

** server can't find login.server.domain NXDOMAIN

What could be happening? Why is this only replicating within our network?

FYI we have waited over 48 hours for replication, so is not a time issue.

Adding more info: It's been longer thant 48 hrs, I can't share more info because I'm the product manager pushing this and the IT guys have yet to confirm more details. I 'll get back to this when I get more info.

share|improve this question

closed as off-topic by Ward, Jenny D, Sven May 19 '15 at 10:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

you're going to have to provide WAY more information. what type of DNS servers? what have you done to troubleshoot so far? are your DNS servas actually authoritative externally or is someone else hosting your external DNS? – longneck Aug 28 '12 at 15:38
DNS doesn't propagate. – joeqwerty Aug 28 '12 at 15:47
Actually, 48 hours isn't long enough in the default case. I think the general rule of thumb is t allow 72 hours for a record to fully propagate. (Though, I bet the posted answer is correct about the cause of your issue. Updating a record on a nameserver that only serves internal clients won't help for external DNS lookups.) – HopelessN00b Aug 28 '12 at 15:48
@joeqwerty Sure it does. It just doesn't propagate often. I remember when DNS finally propagated to Windows with the release of Server 2000, for example. :p – HopelessN00b Aug 28 '12 at 15:50
Just in case @HopelessN00b's comment flew over some heads: DNS doesn't "propagate" at all. Answers to queries are cached (in the case of endpoint clients or caching resolvers), and old cached entries expire; it is the expiration time of the old entry that causes people to (incorrectly) assume that the new data has to somehow be replicated to other servers. – adaptr Aug 28 '12 at 16:00
up vote 6 down vote accepted

Your organization has probably implemented a "split horizon" DNS (it's a configuration commonly used to prevent internal hostnames from being looked up by an external client) and login.server.domain got into the internal zone.

Try to see if that's the case and, if yes, move the domain to the external zone, wait for propagation and check again.

share|improve this answer

In order to verify that a particular nameserver at least has the correct answer for a request you might make of it, use:

dig @<IP address of server> <name that you want resolved>

This way you can check individual servers and not have to wait for caches to expire/propagation.

Other than that, we need more information.

1) Which nameserver software are you using? If you're using bind, use named-checkzone(8) to verify the zone file and post the relevant section.

2) Do you have any records in that zone working correctly? Look at the difference between the config for the one(s) that work and the one that doesn't.

3) Which servers have the SOA?

4) You can use to get some suggestions about whether your DNS(server) is set up correctly.

share|improve this answer

There needs to be a . after the domain name.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.