As seen on https://dnsviz.net/d/lettresnoires.com/Xsscfw/dnssec/ you have a DNSSEC misconfiguration. You are publishing a DS
record in your parent (the registry) but you are not publishing the associated DNSKEY
in your zone. This is akin to a lame delegation, except that in DNSSEC case any failure like this is met with a fatal complete error, that is NXDOMAIN
exactly as if your domain name does not exist at all.
You can easily debug that yourself using dig
and its +cd
flag that disables DNSSEC: if something does not work, but then works if you add +cd
it is most probably a DNSSEC related problem:
$ dig @9.9.9.9 lettresnoires.com NS | grep -A 1 "Got answer:"
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 56010
$ dig @9.9.9.9 lettresnoires.com NS +cd +noall +ans
lettresnoires.com. 58m48s IN NS ns1.ssdlinux33.com.
lettresnoires.com. 58m48s IN NS ns2.ssdlinux33.com.
There is nothing stuck, nor propagation, as that does not exist in the DNS.
Your current configuration is wrong, and nothing will fix up itself unless you act.
Your DNS provider (ssdlinux33.com
) should have been able to help you (if that is not you directly).
Based on your question, it does not seem that DNSSEC was something you wanted to have as you do not manage it properly. At this stage it would be then better to just remove the DNSSEC configuration until you understand things better.
For this you need to go through your registrar:
$ wget -qO - https://rdap.verisign.com/com/v1/domain/lettresnoires.com | jq '.entities[0].vcardArray[1][1][3]'
"Name.com, Inc."
A search on the global list of registrars at https://www.internic.net/alpha.html shows that its website is https://www.name.com/
So go to your registrar, find the panel and the option to change DNSSEC/DS records, and just remove the DS record you see there. Your registrar will then send that order to the registry and the registry will stop to publish the DS
record, after which everything will start to work normally (or at least you won't have an hard failure due to DNSSEC).
Since the record is published like that for now:
$ dig @a.gtld-servers.com DS lettresnoires.com +noall +ans
lettresnoires.com. 1d IN DS 28675 13 2 (
23F5FFCB9D04679D525EDBFDEB0A1F8CD42C8B933F89
F9CBCC2B1F7EA6F3116C )
it means you will need to wait up to 1 day (this is the 1d
as first token in the reply) after you made your change at the registrar and you have seen that the registry does not publish the record anymore (the above dig
query can easily show if the record is published or not).
I recently moved one of my domains to a different server.
- What does that mean? What did you move, exactly?sg1/sg2.cloudhostingforlinux.com
to their currentns1/ns2.ssdlinux33.com
on May 19th.