I have couple of Hetzner 'root servers' (as they call it - dedicated co-located linux machines) and all of them experience the same problem (which i simply do not fully understand).

The domain www.dnsblchile.org does not want to resolve to an IP (servers are installed from Hetzner own Debian Jessie images). All other domains of course resolve properly (i did not experience any problems before with any other domains resolving - or i did not spot it before).

When i test nslookup -type=A www.dnsblchile.org i get:

;; Got SERVFAIL reply from, trying next server
;; Got SERVFAIL reply from, trying next server

** server can't find www.dnsblchile.org: SERVFAIL

so NO proper answer here, but when i try using (google) as nameserver like nslookup -type=A www.dnsblchile.org i get:


Non-authoritative answer:
Name:   www.dnsblchile.org

so everything is OK here and i get proper IP.

The contents of `/etc/resolv.conf' (default after installation) is:

### Hetzner Online GmbH installimage
# nameserver config

If i add the as a new entry to /etc/resolv.conf all is working just fine as well.

Now - is it something wrong on Hetzner nameservers configuration side or shall i just use nameserver instead (as a good practice)?
I'm talking to Hetzner support for two days already but have no common ground here - hearing that their nameservers are all perfectly fine.
Shall their own nameservers as well properly resolve the www.dnsblchile.org domain?

update from support:

..but as the domain are using nameservers which are not allowing requests from our resolvers the domain can not be resolved. If you want to resolve the domain you have to use other resolvers or maybe own resolvers, which are allowed to request the nameservers of the domain

Now - may their nameservers be 'blocked' like they say (i'm not an expert here)?

As well - is it a common practice (as the answer below suggests) to use e.g. google name server and just skip Hetzner nameservers setup?
Would i just add the google name server to the list (at top or bottom of /etc/resolv.conf file) and shall i remove the Hetzner nameservers (or leave them)?

  • 1
    I've just tried this from my Hetzner VPS, and I confirm your results. It looks to me like Hetzner's nameservers are doing something wrong, and reproducibly so. You have something clear-cut to show them: you can resolve that A record off google, and you cannot resolve it off their nameservers. I'm not sure how it's taken them two days to get their heads around that. – MadHatter Sep 2 '16 at 11:27
  • On your update: yes, it's perfectly possible that dnsblchile.org's authoritative nameservers could be blocking or ignoring requests from Hetzner's servers, though I can't imagine why they'd do such a thing. You'd have to ask them about that. – MadHatter Sep 2 '16 at 15:33

I don't understand why you are still trying to use the Hetzner DNS servers if they are demonstrably not working correctly. Just update your /etc/resolv.conf appropriately and get on with your life.

I usually chuck and (or 2001:4860:4860::8888, 2001:4860:4860::8844) in and forget about it.

  • Is it assumed a good practice to use e.g. google nameservers ? – Mc Bton Sep 2 '16 at 13:34
  • Whilst I hardly ever disagree with Iain, because he's almost always right, I'm going to disagree this time. I make a point of never using google's nameservers for long periods on production equipment. I'm very sure google log and mine the lookup data, and I have no intention of going round configuring my clients' equipment to leak information to google, who have quite enough of it already. If I were you, I'd keep pressing Hetzner to fix their nameservers. But I'm fairly bloodyminded about a lot of things, and I concede Iain's plan is a lot simpler. – MadHatter Sep 2 '16 at 13:43
  • @MadHatter Google helpfully tell you exactly what they log. – Michael Hampton Sep 2 '16 at 14:19
  • @MichaelHampton that's informative, thank you. That said, I won't be changing my policy, because Google don't covenant to never plumbing that information more than they do now, and I don't have time to keep revisiting the page to check they've not changed their position. What I don't give them, they definitely can't abuse. – MadHatter Sep 2 '16 at 15:30
  • 2
    man 5 resolv.conf – user9517 Sep 2 '16 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.