Why are many DNS servers not returning the namservers for my domain correctly?

Question

My website has become widely inaccessible and I don't know why.

Up until recently I have been serving my website through cloudflare, so was using their nameservers. Recently I started using Route 53, so I changed to Amazon's name servers using my registrar's control panel, and found that my site quickly became unavailable (I am in the UK).

I used https://www.whatsmydns.net and found that some DNS servers around the world were not returning any namservers for my website. It was the same locations every time I tried, including London, Sao Paolo, Germany, New Zealand and parts of the US. Most locations (around 3/4) were fine though.

I was using hover.com as my registrar at the time, and I thought that the problem might have been to do with them, so I switched registrars to Amazon. Once transferred to Amazon, I changed the nameservers back to Cloudflare's nameservers, waited for it to propagate, and checked again on whatsmydns.net. It was showing up green for all locations. Then I changed back to Amazon's nameservers. The problem was exactly the same as before, the nameservers were not returned by DNS queries in the same locations.

I have changed the DNS servers on my Mac laptop, and can access my website when using the following DNS servers:

• Sky (my broadband provider) - 90.207.238.97 and 90.207.238.99
• OpenDNS Home - 208.67.222.222 208.67.220.220

But my website is inaccessible when using the following DNS servers

• Google - 8.8.8.8 and 8.8.4.4
• Cloudflare - 1.1.1.1 and 1.0.0.1
• Quad9 - 9.9.9.9 and 149.112.112.112
• CleanBrowsing - 185.228.168.9 and 185.228.169.9
• Adguard - 176.103.130.130 and 176.103.130.131
• Verisign - 64.6.64.6 and 185.253.163.131

The nameservers I am trying to use are:

• ns-1478.awsdns-56.org
• ns-1953.awsdns-52.co.uk
• ns-135.awsdns-16.com
• ns-893.awsdns-47.net

I have read that some large ISPs have configured their DNS servers to violate rules, such as by indicating that a domain name does not exist just because one of its name servers does not respond. To try and diagnose if this was occurring, and there was a problem with one of the 4 nameservers, I changed yesterday to use just the first 2 nameservers in the list above, intending to then use just the second two if there was still a problem. However, even though this change has had ample time to propagate (EDIT: perhaps not, given the TTL, but it definitely seems slower than when I changed the nameservers between Amazon's and Cloudflare's and vice versa), whatsmydns.net is showing that the vast majority of DNS servers are still returning all 4 nameservers. I am not sure why that is happening.

What is going on! My website is https://www.markfisher.photo.

Answer 1

I had a quick look and the main problem with your zone seems to be that the delegation from the parent zone (photo) indicates that markfisher.photo is supposed to be signed (DS record present).

markfisher.photo however is not signed at all. The result of this is that any validating resolver will consider all answers bogus and discard them.

To my knowledge Route53 still does not support DNSSEC, which means that if you want to use that DNS service you need to remove any DS records from the delegation (done through your registrar).

Demonstration of the problem in two steps:

$ dig @ns1.uniregistry.net markfisher.photo +norec +dnssec

; <<>> DiG 9.11.13-RedHat-9.11.13-3.fc31 <<>> @ns1.uniregistry.net markfisher.photo +norec +dnssec
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55361
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 60e53f6e7a4d79f37a0879a75e14e274510b02d97b10da1c (good)
;; QUESTION SECTION:
;markfisher.photo.              IN      A

;; AUTHORITY SECTION:
markfisher.photo.       900     IN      NS      ns-1478.awsdns-56.org.
markfisher.photo.       900     IN      NS      ns-1953.awsdns-52.co.uk.
markfisher.photo.       900     IN      DS      2371 13 2 B1FB8D1E60D7B54027829321A64B612251F95A41C0F10C912FA9FC6A 9EECEEA5
markfisher.photo.       900     IN      RRSIG   DS 5 2 900 20200206185213 20200107185213 21795 photo. AN2TWw41LL15uX55vfNaQlHvidlpngYb629gSlEyP+A3JiS77NHO5TvJ gI5QF4si5/haBEoABpuVU8opxxC0Jmv3aD09NkwjZXoqikxDqwjzO/PD wNlvHKOb25fgb1+gKj3JaGvqtAD8m+m2xotmxRo74xPmb2XOvEsGUS25 Cxc=

;; Query time: 94 msec
;; SERVER: 2620:57:4000:1::1#53(2620:57:4000:1::1)
;; WHEN: Tue Jan 07 19:56:36 UTC 2020
;; MSG SIZE  rcvd: 358

$

(referral with DS record, indicating that the markfisher.photo zone is signed with the matching key)

$ dig @ns-1478.awsdns-56.org markfisher.photo DNSKEY +norec +dnssec

; <<>> DiG 9.11.13-RedHat-9.11.13-3.fc31 <<>> @ns-1478.awsdns-56.org markfisher.photo DNSKEY +norec +dnssec
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54714
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;markfisher.photo.              IN      DNSKEY

;; AUTHORITY SECTION:
markfisher.photo.       900     IN      SOA     ns-893.awsdns-47.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 79 msec
;; SERVER: 2600:9000:5305:c600::1#53(2600:9000:5305:c600::1)
;; WHEN: Tue Jan 07 19:58:44 UTC 2020
;; MSG SIZE  rcvd: 129

$

(response from the authoritative server, showing that there are no DNSKEY records, nor are there any signatures)

For a quick overview of DNS delegation as well as DNSSEC health, I can recommend Dnsviz.

Answer 2

the answer is quite easy... DNSSEC ;-)

I have checked it and there is available public keys for DNSSEC signing on upper level (photo.) for your domain. It mean there is enable DNSSEC for it but after your change the servers there is no (or if you want - not valid) DNSSEC signature...

The records is technically correct but it is not passing DNSSEC check for "validity". The result is that it is ignored.

You have to (one of):

• start signing the zone and update the public keys on photo. domain level
• remove the public keys => disable DNSSEC for the zone

Both is related to your domain registrar interface as this information is not located in markfisher.photo. zone but photo. zone (delegated up in principle) like NS records containing which servers would be used.

$ dig www.markfisher.photo @9.9.9.9

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.markfisher.photo @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 38974
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.markfisher.photo.      IN  A

;; Query time: 305 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Út led 07 21:15:44 CET 2020
;; MSG SIZE  rcvd: 49

... and with disabled DNSSEC check :

$ dig +cdflag www.markfisher.photo @9.9.9.9

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> +cdflag www.markfisher.photo @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26962
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.markfisher.photo.      IN  A

;; ANSWER SECTION:
www.markfisher.photo.   298 IN  CNAME   markfisher.photo.
markfisher.photo.   60  IN  A   54.240.168.66
markfisher.photo.   60  IN  A   54.240.168.56
markfisher.photo.   60  IN  A   54.240.168.98
markfisher.photo.   60  IN  A   54.240.168.51

;; Query time: 1770 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Út led 07 21:14:43 CET 2020
;; MSG SIZE  rcvd: 127