UPDATE: resolved, answer at the end of the question
May I know if I had done something wrong? or if something has changed in the last 3~4 years regarding the practice of dns record propagations? the NS record of a subdomain I have setup does not seem to propagate to any public DNS server
I have setup a new subdomain which I plan to delegate its DNS to a specific server.
This was done by setting up a NS record for the subdomain on whois.com
the SOA and NS record are all pointing to whois.com
dig @8.8.8.8 SOA mydomain.com
;; ANSWER SECTION:
mydomain.com. 7200 IN SOA ns1.whois.com. someemail.someemail.com.
dig @8.8.8.8 NS mydomain.com
;; ANSWER SECTION:
mydomain.com. 21600 IN NS ns2.whois.com.
mydomain.com. 21600 IN NS ns4.whois.com.
mydomain.com. 21600 IN NS ns3.whois.com.
mydomain.com. 21600 IN NS ns1.whois.com.
I have setup a subdomain record for a name server I want to use
dig @8.8.8.8 ns.mydomain.com.
;; ANSWER SECTION:
ns.mydomain.com. 28800 IN A 88.22.66.11
after setting up the NS record for the subdomain, on the whois.com server it looks like below
dig @whois.com SOA subdomain.mydomain.com #both query came back the same
dig @whois.com NS subdomain.mydomain.com
;; QUESTION SECTION:
;subdomain.mydomain.com. IN SOA
;; AUTHORITY SECTION:
subdomain.mydomain.com. 38400 IN NS ns.mydomain.com.
;; ADDITIONAL SECTION:
ns.mydomain.com. 28800 IN A 88.22.66.11
so I think the setting is correct already.
however I have waited for more than 2 days, but seems none other public DNS server had picked up on that, I have tried others such as 1.1.1.1 and cisco name server as well
dig @8.8.8.8 NS subdomain.mydomain.com
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 38946
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;subdomain.mydomain.com. IN NS
and remembering I have done the same setup for another subdomain 3~4 years ago, but the ns server later decomissioned without me ever changing any DNS record, I tried checking for the other domain
dig @8.8.8.8 NS oldsubdomain.mydomain.com
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;oldsubdomain.mydomain.com. IN NS
dig @whois.com NS oldsubdomain.mydomain.com
;; QUESTION SECTION:
;oldsubdomain.mydomain.com. IN SOA
;; AUTHORITY SECTION:
oldsubdomain.mydomain.com. 38400 IN NS ns2.mydomain.com.
;; ADDITIONAL SECTION:
ns2.mydomain.com. 28800 IN A 88.22.66.112
strangely the record seems to have also disappeared from other public DNS servers, except the whois.com name servers.
ANSWER
turns out named was not listening to port 53 on ipv4 on actual network interfaces
[]# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 29722/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 29722/named
tcp6 0 0 :::80 :::* LISTEN 29722/named
tcp6 0 0 ::1:953 :::* LISTEN 29722/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 29722/named
udp 0 0 0.0.0.0:5353 0.0.0.0:* 9134/avahi-daemon:
udp6 0 0 ::1:53 :::* 29722/named
dig @127.0.0.1 subdomain.mydomain.com
;;have answer
#assume 123.123.123.123 is public IP of server
dig @123.123.123.123 subdomain.mydomain.com
;;time-out no answer
I fixed by adding the public IP to named.conf
listen-on port 53 { 127.0.0.1; 123.123.123.123; };
so previously because the ns.mydomain.com server is not answering any dns query, that was the main issue.
My confusion is that I have mixed up the ns record with soa record, I thought by setting the NS record of the subdomain name, the SOA is already in place, actually that needs to come from the NS server. And my NS server was not able to use nsupdate on bind because of failed SOA query, which caused some circular logic in my own investigation.
subdomain.mydomain.comdefined in your zone file?