14

I have a certain domain I manage, which was moved to DNSmadeeasy a week ago. But sometimes when I do a dig request I get a weird IP back on the A record: 166.62.3.1

Others are reporting the same, from different locations. It seems to be random though, as most report the correct IP.

DNSmadeeasy say nothing is wrong in their end as usual, so I have no idea how this IP is getting out there.

The domain is: elyseecollective.com.au

Some dig results are here

23

The authoritative answers for the ns{1-6}.maccentrecloud.com.au names point to:

ns1.maccentrecloud.com.au. 1800 IN      A       208.94.148.4
ns2.maccentrecloud.com.au. 1800 IN      A       208.80.124.4
ns3.maccentrecloud.com.au. 1800 IN      A       208.80.126.4
ns4.maccentrecloud.com.au. 1800 IN      A       208.80.125.4
ns5.maccentrecloud.com.au. 1800 IN      A       208.80.127.4
ns6.maccentrecloud.com.au. 1800 IN      A       208.94.149.4

But the glue records don't quite match:

ns1.maccentrecloud.com.au. 900  IN      A       208.94.148.4
ns2.maccentrecloud.com.au. 900  IN      A       112.140.180.10
ns3.maccentrecloud.com.au. 900  IN      A       208.80.126.4
ns4.maccentrecloud.com.au. 900  IN      A       208.80.125.4
ns5.maccentrecloud.com.au. 900  IN      A       208.80.127.4
ns6.maccentrecloud.com.au. 900  IN      A       208.94.149.4

Update the glue (through the registrar for maccentrecloud.com.au).

(ns2.maccentrecloud.com.au. / 112.140.180.10 responds differently, and the bad glue puts it into the mix of who should be queried)

  • Can you add sample commands that would let someone verify these results? – mgarciaisaia Oct 17 at 3:55
  • 1
    @mgarciaisaia: dnstracer -s . <domain> can be used to quickly see the delegations. For the actual comparison, you would run dig <domain> NS @<server> against both sets of servers – once against the domain owner's ns# servers themselves, and then once against the parent TLD's nameservers which hold the "glue" records (e.g. for com.au they are t.au, r.au, q.au, etc). – grawity Oct 17 at 5:56
10

You have 6 name servers. 2 of them have the wrong zone information. Thus most of the time the answers are correct, but occasionally you hit a bad DNS server.

I'm not at my PC at the moment but you can check what each server is returning with a command like

  dig @nsX.maccentrecloud.com.au elyseecollective.com.au A

For each nameserver and find the faulty ones. Then get the DNS provider to fix them or remove them from your registrars name server records for the domain.

  • 7
    The issue with this test is that it will look up the name nsX.maccentrecloud.com.au itself, ie the authoritative answer, and then send the specified query there. This doesn't play nice with looking for glue record mismatch, which seems to have been the problem in this case. – Håkan Lindqvist Oct 16 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.