Getting confusing results from a domain+zone both in AWS.

My domain has four nameservers:


I have the following hosted zone and record (in addition to the standard NS and SOA records):

example.com.   A

If I run dig example.com +noall +answer I receive an empty response instead of the expected example.com 1 IN

However, if I perform these nslookup I receive the expected responses:

nslookup example.com ns-604.awsdns-11.net
nslookup example.com ns-493.awsdns-61.com
nslookup example.com ns-1032.awsdns-01.org
nslookup example.com ns-1574.awsdns-04.co.uk

Server:         ns-1574.awsdns-04.co.uk

Name:   example.com

I also receive a 2(SERVFAIL) from host

host example.com
Host example.com not found: 2(SERVFAIL)

Not sure what's going on here. nslookup shows that my DNS is pointed to the right IP, but host and dig both fail.

  • what if you run host mydomain.com or dig mydomain.com @ – Andrew Apr 4 '18 at 21:43
  • @Andrew I get Host mydomain.com not found: 2(SERVFAIL) and an empty answer section, respectively. – diplosaurus Apr 4 '18 at 21:54
  • Did you set your nameservers at your domain registrar? Not doing so is the usual cause of this problem. – Michael Hampton Apr 4 '18 at 22:18
  • @MichaelHampton AWS/Route53 is also the registrar, and the nameservers on the domain are identical to the namservers in the hosted zone's NS record. – diplosaurus Apr 4 '18 at 22:36
  • Did you only just purchase the domain, then? – Michael Hampton Apr 4 '18 at 22:37

As the Zonemaster test you have done (https://zonemaster.net/test/25323900ede06c1b) shows your domain, we would have been able to reply sooner with more helpful information if you did give it right at the start.

Anyway, the test is ok which means there is no lame delegation, the set of NS records in your parent zone and in your own zone match.

Indeed they are:

nickbrown.me.       60  IN  NS  ns-1052.awsdns-03.org.
nickbrown.me.       60  IN  NS  ns-1569.awsdns-04.co.uk.
nickbrown.me.       60  IN  NS  ns-319.awsdns-39.com.
nickbrown.me.       60  IN  NS  ns-753.awsdns-30.net.

Note that these are NOT the ones you give in your question.

If you query any of them, for an A record at the apex they all reply with so this is consistent and working. Your zone is correctly installed and works.

Now if we try some "well known" open recursive resolvers: both Google (, Quad9 ( and Cloudflare ( reply with the same answer.

So in short everything works, except that from your question you do not test the correct authoritative nameservers, and you do not specify exactly which recursive ones you use so they may have problems or have specific configurations for your zone.

Since whois shows your domain had an update recently (2018-04-04T21:43:23Z) you may have changed something and not tested things correctly at the correct time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.