-1

Got a strange problem, where I can get the TXT records for a domain when I query the domains name servers directly, but otherwise I get a not found: 2(SERVFAIL).

if I do

dig example.com TXT @ns1.david.com

Where ns1.david.com is shown in the AUTHORITY SECTION. Then I get an answer section containing the TXT record I expect. But if I omit the nameserver part

dig example.com TXT

Then I do not get the TXT records in the response, but instead:

->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53682

All other types of record (A, AAAA, MX and CNAME) are working fine.

If I use MXToolbox to do a TXT record for the domain, I get the response "Sorry, we couldn't find any name servers"


edited to add info for DNSviz:

I've got one error and two warnings. The error is:

example.com/TXT: The response had an invalid RCODE (SERVFAIL). (35.187.100.54, 35.189.95.99, 35.198.143.85, 35.204.14.72, UDP_-_NOEDNS_)

The first warning is:

com to example.com: The following NS name(s) were found in the authoritative NS RRset, but not in the delegation NS RRset (i.e., in the com zone): ns1.david.com, ns2.david.com

and the second is:

com to example.com: The following NS name(s) were found in the delegation NS RRset (i.e., in the com zone), but not in the authoritative NS RRset: ns1.peter.com, ns2.peter.com, ns3.peter.com, ns4.peter.com
5
  • 1
    SERVFAIL implies that something is wrong, not just a cache delay or something like that. You may want to check dnsviz.net and add more information to the question (like the domain name) Jan 27, 2021 at 15:32
  • The DNSViz errors means you are in a lame delegation setup. Fix your DNS setup by updating properly the nameservers list (by going through your registrar). You could have gotten far better replies if you provide the name, which is public anyway. And stop obfuscating badly, .dom is not a valid TLD. Also DNS records do not "propagate" as they are not updated in a top down fashion. Query authoritative nameservers first (but beware of lame delegation cases) then recursive ones. Jan 27, 2021 at 17:14
  • @PatrickMevzek Thank you for the pointers, could you clarify what you mean by 'updating properly the nameservers list'? I don't want this SF account associated with the domain in question, which is why I can't use it. The .dom was a typo which I'll fix. The word "propagate" does not imply top down.
    – Dom
    Jan 27, 2021 at 17:28
  • 'updating properly the nameservers list' what you quote as DNSViz error shows you are in a lame delegation scenario: the parent (registry) authoritative nameservers believe that the authoritative nameservers for your domain are (A, B, C, D) but when you ask any of those nameservers what are the authoritative nameservers on the domain they say it is (X, Y, Z, W). The fact that the two lists are not exactly the same is called a lame delegation, and it has to be fixed because it creates at least delays in resolution and at worst, like probably in your case, full DNS resolution errors. Jan 27, 2021 at 18:27
  • " The word "propagate" does not imply top down." Yes it does, and it is wrong in the DNS world, there is no propagation. Nothing gets updated without a specific DNS query (from any recursive nameserver that will then update its cache). If authoritative nameservers have new content, but if a given recursive nameserver does not query them, then its cache does not get updated at all. The cache will expire after some time (the TTL of the relevant records) and will get replenished, outside of edge cases, ONLY if a query is made for the record, otherwise changes won't appear. No propagation. Jan 27, 2021 at 18:30

1 Answer 1

1

I will note that there could be multiple problems at play, but based on the information shared in the question the the currently known problem is that the delegation NS records do not match the authoritative NS records.

You will want to decide which set of nameservers is actually supposed to be used for this zone, then add/remove NS records in the zone itself as well as the delegation (managed through the registrar) so that the same set of nameservers are in both places.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .