25

Our domain, grahamhancock.com is being wrongly resolved by a few people around the world, but it resolves correctly for most people.

When I run through a list of free open DNS providers, about 90% resolve correctly and give information consistent with our zone file. 10%, however, do not, and claim the IP address to be one linked to some Amazon EC2 instance which we've never owned or used ever in the past. Here are some example DNS servers giving the wrong information:

dig www.grahamhancock.com @173.84.127.88
dig www.grahamhancock.com @209.222.18.222

How could these servers have the wrong information, and how can we get back control of the situation?

Could this be something malicious, or a misconfiguration? We're a 1-million-hits-a-month site, with good search rankings, so we're probably a target for something malicious. The wrong IP address that the erroneous server are returning to some people points to some get-rich-quick site on an AWS EC2 instance.

What should we do?

7
  • 1
    Is that the actual domain name?
    – Drifter104
    Jul 30, 2015 at 14:28
  • 1
    Yes, that's the real domain. Jul 30, 2015 at 14:39
  • Some DNS server are badly configured too, the question is why your customer does not use their ISP DNS ? as atleast you can ask a hotline to get it fixed if on a ISP DNS.
    – yagmoth555
    Jul 30, 2015 at 14:45
  • Our users are using their ISP's DNS servers, but those servers won't accept my queries since I'm not their customer. The DNS servers above are public, and so I used them to test. If they're misconfigured, they're misconfigured in the same way, and have suddenly become misconfigured, since this wasn't happening yesterday. Here is the IP of one our user's ISP's DNS servers: 177.86.168.11. Our other users weren't responsive or proficient enough to give us their DNS server's IP. Jul 30, 2015 at 14:49
  • 6
    May I in passing profoundly thank the original poster for including the actual domain name in his question, rather than redacting it? As I have had occasion to note before, DNS questions are members of that class which are much easier to answer quickly and canonically when full dsclosure is made, and I personally think the very high quality of answers this question has had is partly due to many eyeballs being able to look directly at the problem.
    – MadHatter
    Aug 1, 2015 at 6:32

2 Answers 2

44

Drifter is correct, you have a nameserver configuration problem. Here's the tail end of the output from dig +trace +additional www.grahamhancock.com:

grahamhancock.com.      172800  IN      NS      ns1.grahamhancock.com.
grahamhancock.com.      172800  IN      NS      ns2.grahamhancock.com.
grahamhancock.com.      172800  IN      NS      server.grahamhancock.com.
ns1.grahamhancock.com.  172800  IN      A       199.168.117.67
ns2.grahamhancock.com.  172800  IN      A       199.168.117.67
server.grahamhancock.com. 172800 IN     A       199.168.117.67
;; Received 144 bytes from 192.35.51.30#53(f.gtld-servers.net) in 92 ms

www.grahamhancock.com.  14400   IN      CNAME   grahamhancock.com.
grahamhancock.com.      14400   IN      A       199.168.117.67
grahamhancock.com.      86400   IN      NS      ns2.grahamhancock.com.com.
grahamhancock.com.      86400   IN      NS      ns1.grahamhancock.com.com.
;; Received 123 bytes from 199.168.117.67#53(ns2.grahamhancock.com) in 17 ms

Your glue records are pointing to an IP address of 199.168.117.67, which returns the correct response. Your zone however is defining nameserver records ending in com.com. If we +trace one of those nameservers instead...

com.com.                172800  IN      NS      ns-180.awsdns-22.com.
com.com.                172800  IN      NS      ns-895.awsdns-47.net.
com.com.                172800  IN      NS      ns-1084.awsdns-07.org.
com.com.                172800  IN      NS      ns-2015.awsdns-59.co.uk.
;; Received 212 bytes from 192.26.92.30#53(c.gtld-servers.net) in 22 ms

ns1.grahamhancock.com.com. 30   IN      A       54.201.82.69
com.com.                172800  IN      NS      ns-1084.awsdns-07.org.
com.com.                172800  IN      NS      ns-180.awsdns-22.com.
com.com.                172800  IN      NS      ns-2015.awsdns-59.co.uk.
com.com.                172800  IN      NS      ns-895.awsdns-47.net.
;; Received 196 bytes from 205.251.195.127#53(ns-895.awsdns-47.net) in 16 ms

...we end up at someone's AWS hosted nameservers.

Your problem is something known as a glue record mismatch. Remote nameservers are initially learning about your domain via the glue records, but once those remote servers perform a refresh they end up querying the bogus nameservers that you've defined with an extra .com at the end.

This is not your only problem. You are listing the same IP address three times in your glue records, which is extremely volatile. You should always have multiple nameservers, they should never share a subnet or upstream network peer, and they should never be located at the same physical location. As matters currently stand, any brief routing problem between DNS servers and your single server will cause your domain to be temporarily unreachable.


Update:

This Q&A has been featured on the front page and is getting lots of comments. Unfortunately, that includes people who are just a little too eager to reply to this answer without checking to see if their points have already been addressed in the expanded comments.

The detail that most people seem to be overlooking is the comment that I'm quoting here:

  • [...] geo-redundant DNS servers prevent scenarios where a brief routing interruption results in temporary negative caching of nameservers. However brief the negative caching period ends up being, it will almost certainly exceed the amount of time that there was a connectivity interruption. [...] the number of scenarios where lack of DNS geo-redundancy won't create sporadic and difficult to troubleshoot availability problems is exactly zero.

If you think my understanding of negative caching of nameservers is wrong, that's open game for discussion, but outside of that you need to bring something to the table other than "it's a small site and who cares if both the website and DNS server are down at the same time". If you're saying this you don't understand the topic nearly as well as you think you do.

Second Update:

I went ahead and wrote a canonical Q&A that we can link to whenever the single DNS server topic comes up in the future. Hopefully this puts the matter to rest.

16
  • 15
    It doesn't matter what you see in the control panel, this is the reality of it. dig @199.168.117.67 grahamhancock.com NS makes this explicitly clear -- that data is coming from your servers. As for this being a "financial problem", I'm going to be blunt here: if you aren't going to run redundant DNS servers, you have absolutely no business operating your own DNS. You will have downtime. Unless you're very close to the owner, you will be responsible for that downtime and allowing this configuration to be implemented.
    – Andrew B
    Jul 30, 2015 at 15:24
  • 1
    I hear you, but it's out of my hands. Anyway, thanks for the help. Jul 30, 2015 at 15:26
  • 2
    @Bodo Fair enough. That said, you're still overlooking the fact that geo-redundant DNS servers prevent scenarios where a brief routing interruption results in temporary negative caching of nameservers. However brief the negative caching period ends up being, it will almost certainly exceed the amount of time that there was a connectivity interruption. (or to put it more simply since I can't keep replying to this: "blah blah blah DNS blah, the number of scenarios where lack of DNS geo-redundancy won't create sporadic and difficult to troubleshoot availability problems is exactly zero".)
    – Andrew B
    Jul 30, 2015 at 18:44
  • 15
    You can get DNS hosting for $1 with redundant NS servers. It's not a financial choice. Don't be a cowboy.
    – JamesRyan
    Jul 30, 2015 at 22:24
  • 4
    There are plenty of free secondary DNS providers that are adequate for low-load zones. Or as @JamesRyan said above one can pay a (very small) amount of money for a professionally managed service with some sort of SLA. Both are viable alternatives for low-traffic sites.
    – user
    Jul 31, 2015 at 9:49
11

Using the following tools gives a couple of clues

https://www.whatsmydns.net/#NS/grahamhancock.com reports that the NS records on the domain point to ns1.grahamhancock.com.com notice the extra .com

http://mxtoolbox.com/SuperTool.aspx?action=dns%3agrahamhancock.com&run=toolpage also reports that the same nameserver is reporting as authoritative.

If you take a look here http://www.dnsstuff.com/tools#dnsReport|type=domain&&value=grahamhancock.com it also reports that your names servers are open.

So it would appear somewhere along the line the nameservers are not set correctly. If they appear correctly to you through a control panel etc, you will need to speak to the provider so that they can check them on the actual servers.

Those links also have a full report on best practices and how to deal with them

1
  • 22
    And the parasites^H^H^H^H^H^H^H^H^Hpeople at com.com have configured wildcard DNS to take advantage of this kind of mistake. If your NS record points to anything.com.com they will answer whatever queries they get in a way that directs traffic to them. Try dig @anything.com.com anyotherthing.com and check out the authority and additional sections of the reply!
    – user193597
    Jul 30, 2015 at 15:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .