0

I manage a VPS which hosts a forum and recently we migrated from one physical VPS host to another in the same company, with a downtime of about 48h and all configuration was made with cpanel full account backups.

Since then, our users reported intermittent DNS failures. Most of them report things like normal behaviour from midnight until noon and DNS failures from noon to midnight. They are also under corporate networks and are unable to change their DNS server settings. (And I also believe that solving this kind of problems by suggesting client-side settings changes isn't an elegant solution for a large-ish website)

One of the moderators is experiencing this kind of error and sent me the following dig output:

; <<>> DiG 9.7.0-P1 <<>> clubecetico.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56625
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;clubecetico.org.        IN    A

;; ANSWER SECTION:
clubecetico.org.    7246    IN    A    193.164.133.22

;; AUTHORITY SECTION:
clubecetico.org.    70536    IN    NS    ns2.ns-serve.net.
clubecetico.org.    70536    IN    NS    ns1.ns-serve.net.
clubecetico.org.    70536    IN    NS    ns2.ns-service.de.
clubecetico.org.    70536    IN    NS    ns.ns-service.de.

;; ADDITIONAL SECTION:
ns.ns-service.de.    82917    IN    A    194.126.239.242
ns1.ns-serve.net.    56831    IN    A    193.254.189.162
ns2.ns-serve.net.    56831    IN    A    83.243.59.34
ns2.ns-service.de.    82917    IN    A    213.203.228.195

;; Query time: 744 msec
;; SERVER: 200.198.34.81#53(200.198.34.81)
;; WHEN: Fri Sep 20 16:20:53 2013
;; MSG SIZE  rcvd: 209

Here, using google's 8.8.8.8 and 8.8.4.4 the error never occurs and the output is

; <<>> DiG 9.9.3-P2 <<>> clubecetico.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8975
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;clubecetico.org.       IN  A

;; ANSWER SECTION:
clubecetico.org.    11061   IN  A   193.164.133.22

;; AUTHORITY SECTION:
clubecetico.org.    34589   IN  NS  ns1.clubecetico.org.
clubecetico.org.    34589   IN  NS  ns2.clubecetico.org.

;; ADDITIONAL SECTION:
ns1.clubecetico.org.    19614   IN  A   193.164.133.22
ns2.clubecetico.org.    34589   IN  A   193.164.133.22

;; Query time: 16 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sat Sep 28 13:56:36 BRT 2013
;; MSG SIZE  rcvd: 128

The only DNS configuration I have access to is that the nameservers I should use are ns1.clubecetico.org and ns2.clubecetico.org. In thecpanel` DNS setup, I added an A record with the server's IP.

But I really think that there's something missing because I'm not sure if the DNS client can query ns1.clubecetico.org to obtain the IP of clubecetico.org.

I also have no idea where these ns-service.net come from and why some DNS servers reply with them.

Is there any server-side thing I can do about this issue? Why do these servers reply so differently?

Thanks in advance

1

There is disagreement between the whois and your own NS records:

[me@risby ~]$ whois clubecetico.org
[Querying whois.publicinterestregistry.net]
[...]
Name Server:NS1.CLUBECETICO.ORG
Name Server:NS2.CLUBECETICO.ORG

Compare that with the four NS records you list above. The whois information generally records the delegation information that your registrar will be putting into the .org zonefile, which will control which servers are asked for information about your zone. Until you sort out your delegation, via your registrar, I'm slightly surprised your zone works at all.

  • Thanks, I'm sorting this info out with the person who registered the domain to see if the is any information missing. – Elton Carvalho Sep 29 '13 at 21:30
  • Don't forget that he or she will need the IP address information you quote above; since the name servers are inside the domain in question, glue will need to be provided by (and therefore to) the registrar. – MadHatter Sep 29 '13 at 21:31
  • Ok, @mad, I'm Stumped. My registrar does not seem to allow GLUE records and does not allow IP addresses in the ns fields. We have no relation with this ns-serve thing, it's not related to our host nor our registrar. Our site is in a VPS and, in principle, servers as its own ns. But, how do I really "sort out my delegation"? – Elton Carvalho Oct 16 '13 at 19:29
  • 1
    Get a different registrar. Glue records are completely fundamental to the operation of the DNS, and a registrar that appears not to realise that is worse than useless. – MadHatter Oct 17 '13 at 6:32
0

It's your own nameservers:

$ dig clubecetico.org @8.8.8.8 +trace

the last rows read:

clubecetico.org. 14400 IN A 193.164.133.22

clubecetico.org. 86400 IN NS ns1.ns-serve.net.

clubecetico.org. 86400 IN NS ns2.ns-service.de.

clubecetico.org. 86400 IN NS ns2.ns-serve.net.

clubecetico.org. 86400 IN NS ns.ns-service.de.

;; Received 145 bytes from 193.164.133.22#53(ns1.clubecetico.org) in 102 ms

So then ask your own nameservers for the nameservers:

$ dig -t ns clubecetico.org @ns1.clubecetico.org

clubecetico.org. 86400 IN NS ns1.ns-serve.net.

clubecetico.org. 86400 IN NS ns2.ns-service.de.

clubecetico.org. 86400 IN NS ns2.ns-serve.net.

clubecetico.org. 86400 IN NS ns.ns-service.de.

(sorry for the crap formatting.. editor is being wonky for me)

  • Tanks, @jerm. It's good to know that I can "trace" DNS queries and it solved the ns-serve.de mistery, but doesn't help much with the intermittent DNS erros. Any idea on that subject? Thanks again. – Elton Carvalho Sep 28 '13 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.