If I run dig against a hostname, I get the according cname, however I get an NXDOMAIN error (non existent domain).

if I run dig against the cname I got, I can resolve it to an IP address successfully. It is reproduceable.

On the system I am currently on it is always the case, on other systems it sometimes works and sometimes not, and on other systems it seems to work all the time.

If I run using a nameserver I specify (for example google's public nameserver) I can successfully resolve the hostname.

I would just blame the local system, but it seems I am not having the only one problems.

The 2nd domain (example.net) is hosted on amazon route 53 nameservers. The 1st one on another dns server which has proven to be fully functional and reliable over the years.

I once switched with the other domain to amazon dns as well, everything seemed to work, also various dns health check tests reported fine, however i received a lot of support tickets that dns resolution would not work.

Is amazon just "bad" or am I doing something wrong?

I did not tamper with the domain in any way on the local system (in case of caching or making a custom dns view or whatever...)

joe@joe:~$ dig scorpion.example.com

; <<>> DiG 9.8.1-P1 <<>> scorpion.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10222
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;scorpion.example.com.      IN  A

scorpion.example.com.   180 IN  CNAME   alpha.nue.scorpion.example.net.

;; Query time: 28 msec
;; WHEN: Mon Jun 18 10:28:39 2012
;; MSG SIZE  rcvd: 84

joe@joe:~$ dig alpha.nue.scorpion.example.net

; <<>> DiG 9.8.1-P1 <<>> alpha.nue.scorpion.example.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25381
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;alpha.nue.scorpion.example.net. IN A

alpha.nue.scorpion.example.net. 300 IN A

;; Query time: 48 msec
;; WHEN: Mon Jun 18 10:28:47 2012
;; MSG SIZE  rcvd: 66

  • In the code section, both queries are done against the local DNS server, and there's a proper answer in both cases. Where and how do you get the NXDOMAIN response? – tstm Jun 18 '12 at 8:47

You're getting an NXDOMAIN on your first request because you're asking for an A (as you can see in the question section) and the server is only responding with a CNAME. So, the issue you're seeing is caused by the DNS-server for example.com, and not by Amazon.

As I understand it, servers will usually return the A-record that the CNAME-record points to as part of the answer to save bandwidth (since, otherwise, that's likely to be your very-next-question). However, I don't think that they have to, and I'm pretty sure that some particularly pedantic DNS servers (I'm looking at you, unpatched-tinydns) don't include the A-record in the answer.

(EDIT: As pointed out by kworr, if the A-name is out-of-bailiwick then you're also relying on the server's willingness to do that recursive query for you)

  • Maybe this is about DNS recursive queries? – kworr Jun 18 '12 at 9:03
  • facepalm @kworr makes a good point that the A-record is out-of-bailiwick, and it's likely that the DNS-server is unwilling to do that recursive query for you. – nickgrim Jun 18 '12 at 9:05
  • ok that makes sense! if i run the question against the dns server of the domain itself the behaviour is the same!! but why does it sometimes work? are other dns servers (like googles) just "intelligent" enough to fix that on the fly?? – The Shurrican Jun 18 '12 at 9:27
  • I'm not sure precisely what you mean by "if i run the question against the dns server of the domain itself the behaviour is the same". However, I'd guess that if the server you're asking already has the (cached) A-record that the CNAME points to, it might choose to return it in the answer section even if it wouldn't look it up if it didn't have it cached (if you see what I mean). – nickgrim Jun 18 '12 at 10:00
  • by that i mean if i specify one of the nameservers that i obtain from the domains whois output as the nameserver to use. however using cnames is a very common thing. especially to external domains. i have tried 3 dns providers now and none of them gave me an A record. only the cname record with a warning that recursion is not available. it seems that isp nameservers seem to "take over that job" in a lot of cases, is this possible? – The Shurrican Jun 18 '12 at 13:20

If you dig the CNAME properly, it will come up.

Straight from the dig man page:

A typical invocation of dig looks like:

        dig @server name type

So, you could query it several different ways, but you always need to specify the type if you expect to get results:

dig @ns-1765.awsdns-28.co.uk alpha.nue.scorpion.example.net cname


; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.el4_5.3 <<>> @ns-1765.awsdns-28.co.uk alpha.nue.scorpion.example.net cname
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25056
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;alpha.nue.scorpion.example.net. IN   CNAME

example.net.          900     IN      SOA     ns-1765.awsdns-28.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 8 msec
;; WHEN: Sun Jul 29 16:05:02 2012
;; MSG SIZE  rcvd: 137

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.