I need help collecting some sort of proof of what might be wrong here

Problem description

location 1

Ping <domain.net> 
Ping request could not find host <domain.net>. Please check the name and try again.

location 2

Ping <domain.net>
Pinging <domain.net> [1XX.62.173.xxx] with 32 bytes of data:
Reply from 1XX.62.173.xxx: bytes=32 time=73ms TTL=57
Reply from 1XX.62.173.xxx: bytes=32 time=70ms TTL=57
Reply from 1XX.62.173.xxx: bytes=32 time=73ms TTL=57
Reply from 1XX.62.173.xxx: bytes=32 time=72ms TTL=57    

location 1 seems to be not limited to my own network but several isp's in sweden

location 2 is work place via vpn which comes out somewhere in uk.

is managed through registrar that points to nameservers of a cloud hosting company Both companies do not see the problem from their location, from their perspective this problem does not exist.

When problem started:

I switch registrar and changed the nameservers,
the domain has propogated fully and it has passed more than 72hours.

if I do

dig SOA @g.root-servers.net net

.. it resolves all they way down to the domain.net correctly.

My gut feeling is some dns server is not updating and I want to find out which one so that I can take this further. So far I have been able to rule out the registrar and the host of the nameservers,based on their claim. I need help troubleshooting. I'm trying not to give away the domain name and servers involved as far as possible.

I have also read related threads and none of them really express the same issue or have any response to solve my problem. If this post is not right for this forum/section please let me know.

Update I have reduced the problem scope slightly by using the registrar nameservers, and using A records to point directly to the server ip. Again I can ping the domain from location 2 when it has fully propogated and not from location 1.

Registrar nameservers


instead of the cloud nameservers on digital ocean


I think you can ping these and see that they have different ip's @Andrew B.

http://www.whatsmydns.net looks ok, this is the main tool I use to verify the propagation most of the time.

Update2 Doing the last modification, I was able to ask the registrar why I was not able to ping domain.net, without them being able to easily blame it on someone else.

So far they have found that domain.net was missing zone file in their system. Having fixed that they discovered that DNSSEC was configured and that they do not support DNSSEC. Probably a configuration that came from previous registrar when doing the transfer? I still don't get why I'm able to ping this domain from location 2 and not from location 1. This domain should have not been reachable from any location?


You can view DNS propagation via http://www.whatsmydns.net but you can identify if this is the issue by having your local resolver test the domain for you at location1 and location2 and comparing (as you are attempting to do already)

If it's working from a host you control, but not 'remote' hosts, my instinct would be to look at the zone and your domain suffix search path. I wonder if you have an improperly scoped entry in the zone (eg an entry that works out as domain.net.domain.net.) Test using domain.net. (include the trailing .) to indicate that it should not use any domain suffix searches, simplifying the test and reducing the number of different possibilities. If it fails with the trailing '.' and works without, you'll know where the fault sits.

Note that dig doesn't use the local resolver the same way ping does (dig it skips your nsswitch.conf for example). Dig won't tell you if you have a broken entry in /etc/hosts or are not properly qualifying the name. I would recommend using host or ping -t (or ping -s on Solaris) to try and separate out the DNS resolution from the ping results a bit - make sure it's either always or never resolving correctly.


This turned out to be DNSSEC configuration. DNSSEC was supported for domain.net by the old registrar and not on the new one I transferred to. As I was pointing name servers for the new registrar further to some cloud hosting, it became very hard to know what was wrong where. For some reason which I still don't understand I was able to access the domain from location 2 but not **location 1*.

So Instead I set the name servers back to the new registrar and used dns record to point to the cloud hosting. This way it was much easier to get passed the support and simply show them that domain.net was not pingable. I should mention that in the end I just ended up pointing the domain.net to the registrar parking site just to get them thinking why this was not working.

Up vote for Smiling Dragon for giving me some constructive feedback.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.