I am having problems understanding what the problem is here. Something isn't adding up.
It started with a website "www.taapcs.ca" not being resolved on our network. One of the managers asked me why it works on his cell phone but not on our network.
I did an nslookup and found that the Non-Authoritative answer had the correct IP address, but when I tried to get an authoritative answer - it couldn't connect.
The non-authoritative answer was showing the name servers as ns5.newtekdns.com. I could ping that host but using "server ns5.newtekdns.com" in nslookup, failed to connect when I ran the query. To make sure it wasn't a problem with nslookup - I tried telnetting on port 53 did not result in a connection. Instead it timed out.
I thought I had the problem solved - their name server was not responding to DNS queries .. but then it got wierd.
I could do authoritative lookups when I tried from other networks outside my own - but not all. ALSO - When I looked at the registrar record on CIRA (the TLD for .ca) .. it showed that the name server was "ns5.webcontrolcenter.com" ... and the last updated date on the record was "2017/05/17" - nearly a year ago.
This made no sense - how did ns5.newtekdns.com even make it into the non-authoritative records??
So I did some googling and found that Newtek had their domains hijacked in February .. and one of those domains was webcontrolcenter.com ...
Okay - explains how webcontrolcenter.com came into the mix .. but it still doesn't explain why I am getting non-authoritative answers of ns5.newtekdns.com when the TLD is reporting ns5.webcontrolcenter.com ... nor does it explain why I can connect to the newtekdns.com DNS server but only from certain networks ..
I thought that maybe some of the ISPs I was using may be blocking any DNS connections other than to their DNS servers .. but I have a VPS on liquidweb and it too was having this issue. So that seems unlikely.
I should also mention too that ns5.webcontrolcenter.com does not resolve.
This is has me stumped a bit .. It seems lame-brain but my gut feeling at this point is that either newtek is trying to out-propagate the TLD .. or the TLDs have some sort of anti-hijacking mechanism in place that can override the registrar's SOA.
Can someone shed some light on this for me?