60

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @JourneymanGeek), and some jovial hacking around we got to the bottom of both your question and the situation on the whole. Sorry for brusqueness and misunderstanding ...


32

In addition to Wesley's excellent answer, I'd like to add that there is already a solution to prevent this. It's called DNSSEC. The basics are this: You register your domain (I'll go with the eminent name wesleyisaderp.com here, just because.) You register your name servers with your registrar, usually via a web interface that you authenticate to with a ...


24

Håkan is basically correct. The approval process for your gTLD included extensive technical testing of the platform serving it, both for conformance to DNS specifications (both RFCs and gTLD-particular specs from ICANN), world-wide availability over both IPv4 and IPv6, performance of registry interfaces (EPP, that is) and more. Since you're using Verisign ...


17

Ugh. I don't normally chime in after so many good people have answered, but I can't entirely agree with any of the answers so far posted. After 20 years of DNS admin, here's my take: Should DNS just be outsourced? No. It's perfectly fine to run your own DNS server (though a static IP address is to my mind essential), and as Vasili notes, it's a good ...


16

DNS records are a hierarchy. Anything at the same level (v1.example.com, v2.example.com, etc) will all be resolved by the NS records set for that level (example.com) You can have different nameservers for different levels / subdomains if you are so inclined, for example (example.com at godaddy, subdomain1.example.com network solutions, subdomain2.example....


15

Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward the authoritative name server(s). The why is probably because with the distributed and delegated nature of DNS it seemed a good idea at the time to include the "...


14

If I'm not mistaken, the problem is that your registrar has published DS records for your domain - that is, DNSSEC signing keys: [me@risby player]$ dig ds ultreyatours.com [...] ;; ANSWER SECTION: ultreyatours.com. 85920 IN DS 49864 8 1 0152C1213569799FAFA42C7699A20132A293F908 ultreyatours.com. 85920 IN DS 20536 8 1 ...


13

There's nothing wrong with having two services go to the same IP address, as long as the destination ports do not conflict with one another. In this case, you would be using port 53 for DNS, and port 80 for your web server. You can also have both (or all) of your nameservers set to the same IP address.* You will need to set up an authoritative DNS ...


13

For whatsmydns.net the Token Mismatch error is related to a timeout of a token generated by the website that allows you to use their search/lookup system. Normally you can refresh the whatsmydns.net website to get a new token and perform searches. It appears they use this token to ensure a 3rd party does not use their system and that instead users go to ...


13

There is nothing you can do to forcibly stop other people from pointing their domains at your server. It may not be malicious; it may be that they have simply made a typo in their zone file, or that they have forgotten to delete an old entry. So the first thing to do is to simply contact them and politely inform them of the error. If they don't respond ...


12

You'll be happy to know that most (if not all) DNS server software has protection against this scenario. For example: Microsoft DNS server has a MaxCacheTTL setting, which defaults to 86400. So regardless of any TTL setting in DNS RRs, if this is not adjusted, the DNS server will not cache anything longer than a day. BIND also has a similar setting max-...


11

If you are running a public accessible DNS server then other clients may be start using you. Maybe to use you as a public resolver or maybe to abuse your service for an DNS amplification attack. If you are not running a public server and have 127.0.0.1 setup as your resolver on that server: It's most likely queries your applications make to resolve ...


11

I don't have personal experience with the operation of a New gTLD but the answer surely must be that it is possible for you to operate your own nameservers (and other services). I think the question rather is "at what cost", to which I do not have a direct answer. IANA's technical requirements for nameservers appears to be a straightforward technical ...


10

Google Domains is a registrar which also offers a DNS service; Google Cloud DNS is a pure cloud-based DNS service, which doesn't handle domain registration but offers higher control and more features on the service itself. When you register a domain, there are two steps involved: the actual registration and the handling of the DNS service for the domain. ...


8

Many DNS servers are pre-configured with version information in DNS TXT records for the version.bind label in the CHAOS class. If this is the case with yours as well, you could retreive it by running dig @dns.name.server version.bind chaos txt Typical answers might include ;; ANSWER SECTION: version.bind. 0 CH TXT "9.8.1-P1" or ;...


8

Looks like your domain registration has expired -- cleangreenpgh.com is on Client Hold status. The expiry date is showing as 2015 because they temporarily add a year to an expired domain to give you a chance to renew before it becomes generally available. See the relevant help page here.


7

Your first record ("blank"/apex/root) can, but probably shouldn't, be a cname; see How to overcome root domain CNAME restrictions? on Stack Overflow: This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other resources ...


7

Zone files on slave DNS servers often do not (and should not) have information to this hidden master DNS server. They can have A records in their zone files to point to this hidden DNS master server. The server is called "hidden" not because no one can ever know about it, but because it's not listed anywhere using NS records so clients can't query them. ...


6

DNS can very well be used for load balancing, but it's only able to do things like simple round robin. If you want to implement something like a high availability solution in DNS, you'll have to disable IPs that are unavailable, for which you would need to set the TTL to some minimum value, which is not a good idea. In general its a much better idea to use ...


6

DNSMasq does this nicely. It is a pretty light weight DNS server. A config that looks like this might be close to what you want. # go.com requests server=/go.com/192.95.16.109 # all other requests server=8.8.8.8 server=8.8.4.4


6

You can use the dig utility from dns-utils (packaged with bind usually), and use the +trace option. Output Your dns servers seem to be "dns200.anycast.me" and "ns200.anycast.me". Is this correct? They returned no response, so start looking there. If you've changed DNS server addresses, the change can take some time to propagate (in my experience, up to ...


6

The technology you are looking for is called Anycast. http://en.wikipedia.org/wiki/Anycast Anycast is a network addressing and routing methodology in which datagrams from a single sender are routed to the topologically nearest node in a group of potential receivers, though it may be sent to several nodes, all identified by the same destination ...


6

These lines are your problem: MYSITE.com. IN NS ns.MYSITE.com MYSITE.com. IN NS ns2.MYSITE.com You need to canonicalise them to stop the domain being reappended: MYSITE.com. IN NS ns.MYSITE.com. MYSITE.com. IN NS ns2.MYSITE.com. This is not the place to ask to be taught about glue records; wikipedia them and read up.


6

You'll be fine so long as you claim ownership of the domain at DigitalOcean (i.e. associate it with your account) before you tell the registrar to use their name servers. If someone has associated your domain with their account already you'll find out before the DigitalOcean nameservers become authoritative. And if that happens, talk to DigitalOcean ...


6

UPDATE: from Google Domains Help: Google Domains pricing and supported TLDs: One important thing to note in default features lists among others: Features included at no additional cost Google nameservers with 10 million DNS resolutions per year And also note: Google Domains is currently available only for users in the US, as mentioned here. ...


6

This being a 'government domain name' is not a factor. It works just like other domains. The mpwt.gov.la zone is not delegated to ns101.ovh.net but rather as seen below: mpwt.gov.la. 3600 IN NS ns2.lanic.gov.la. mpwt.gov.la. 3600 IN NS ns3.lanic.gov.la. mpwt.gov.la. 3600 IN NS ns1....


6

The empty response that you're looking at is a synthetic state known as NODATA. NODATA and NXDOMAIN both indicate that the name does not exist, but NXDOMAIN applies to all names beneath the indicated record as well. NODATA is advising that either that name is associated with records of an unrequested type, or that there are other records that are beneath ...


6

While A firewall that drops UDP DNS packets > 512 bytes. mitigates the exploit (over UDP specifically, TCP can still be an attack vector) it's also not correct behaviour and breaks other functionality instead. Since the introduction of EDNS0 there is no such limit in the DNS spec and you will cause breakages for valid traffic by just dropping packets. What ...


6

There are really two questions being asked here, and they directly contradict each other: how do I instruct DNS servers to continue their query on to Amazon as its authoritative for the domain, without changing the DNS records at the registrar? how do I tell DNS servers to fetch its queries from the Amazon servers and NOT to stop at QuickRouteDNS.COM? ...


6

Route 53 does not support zone transfers. DNS Zone Transfers (AXFR/IXFR) support for Route53 is a hotly asked for feature, and is one that we will consider adding in the future. https://forums.aws.amazon.com/click.jspa?searchID=6666267&messageID=326081 You could, of course, manage your DNS records in an internal system, and programmatically push ...


Only top voted, non community-wiki answers of a minimum length are eligible