DNS not resolving in all locations after a week

Question

I recently moved one of my domains to a different server. It's been over a week and DNS has still not fully propagated, it appears to be stuck, nothing has changed for the past 3 days

Is there anything I am not doing right, anything that could help?

Here is the current state of propagation : https://dnschecker.org/#A/lettresnoires.com

Answer 1

As seen on https://dnsviz.net/d/lettresnoires.com/Xsscfw/dnssec/ you have a DNSSEC misconfiguration. You are publishing a DS record in your parent (the registry) but you are not publishing the associated DNSKEY in your zone. This is akin to a lame delegation, except that in DNSSEC case any failure like this is met with a fatal complete error, that is NXDOMAIN exactly as if your domain name does not exist at all.

You can easily debug that yourself using dig and its +cd flag that disables DNSSEC: if something does not work, but then works if you add +cd it is most probably a DNSSEC related problem:

$ dig @9.9.9.9 lettresnoires.com NS | grep -A 1 "Got answer:"
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 56010


$ dig @9.9.9.9 lettresnoires.com NS +cd +noall +ans
lettresnoires.com.       58m48s IN NS ns1.ssdlinux33.com.
lettresnoires.com.      58m48s IN NS ns2.ssdlinux33.com.

There is nothing stuck, nor propagation, as that does not exist in the DNS.

Your current configuration is wrong, and nothing will fix up itself unless you act. Your DNS provider (ssdlinux33.com) should have been able to help you (if that is not you directly).

Based on your question, it does not seem that DNSSEC was something you wanted to have as you do not manage it properly. At this stage it would be then better to just remove the DNSSEC configuration until you understand things better.

For this you need to go through your registrar:

$ wget -qO - https://rdap.verisign.com/com/v1/domain/lettresnoires.com | jq '.entities[0].vcardArray[1][1][3]'
"Name.com, Inc."

A search on the global list of registrars at https://www.internic.net/alpha.html shows that its website is https://www.name.com/

So go to your registrar, find the panel and the option to change DNSSEC/DS records, and just remove the DS record you see there. Your registrar will then send that order to the registry and the registry will stop to publish the DS record, after which everything will start to work normally (or at least you won't have an hard failure due to DNSSEC).

Since the record is published like that for now:

$ dig @a.gtld-servers.com DS lettresnoires.com +noall +ans
lettresnoires.com.       1d IN DS 28675 13 2 (
                                23F5FFCB9D04679D525EDBFDEB0A1F8CD42C8B933F89
                                F9CBCC2B1F7EA6F3116C )

it means you will need to wait up to 1 day (this is the 1d as first token in the reply) after you made your change at the registrar and you have seen that the registry does not publish the record anymore (the above dig query can easily show if the record is published or not).

Answer 2

It might be a DNSSEC issue. I noticed NSEC3 and RRSIG being returned in the query dig +trace lettresnoires.com @8.8.8.8. I went to https://dnssec-analyzer.verisignlabs.com/lettresnoires.com to check and it does report a few issues. You might need to resolve those DNSSEC issues, or remove DNSSec from your domain.

Old Answer

Did a little "digging" (no pun intended), and the root ".com" servers seem to be all aware of your current name server (using dig +trace lettresnoires.com, then manually querying all the server from a.gtld-servers.net. through m.gtld-servers.net). It looks like your DNS record only has a two hour TTL, which is a little long for a state of transition, but certainly not days.

Have you received any user complaints about the site transition? I manually checked one of the servers that reported your site as unavailable - and the DNS resolution worked fine for your domain. (dig -t a lettresnoires.com @208.67.222.220), which was the Holtsville NY, United States location that reports a failure. Perhaps the DNS checker is not working?

Answer 3

Just disable DNSSEC, if you are not a web host you probably don't need it.