59

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @JourneymanGeek), and some jovial hacking around we got to the bottom of both your question and the situation on the whole. Sorry for brusqueness and misunderstanding ...


32

In addition to Wesley's excellent answer, I'd like to add that there is already a solution to prevent this. It's called DNSSEC. The basics are this: You register your domain (I'll go with the eminent name wesleyisaderp.com here, just because.) You register your name servers with your registrar, usually via a web interface that you authenticate to with a ...


24

Håkan is basically correct. The approval process for your gTLD included extensive technical testing of the platform serving it, both for conformance to DNS specifications (both RFCs and gTLD-particular specs from ICANN), world-wide availability over both IPv4 and IPv6, performance of registry interfaces (EPP, that is) and more. Since you're using Verisign ...


17

Ugh. I don't normally chime in after so many good people have answered, but I can't entirely agree with any of the answers so far posted. After 20 years of DNS admin, here's my take: Should DNS just be outsourced? No. It's perfectly fine to run your own DNS server (though a static IP address is to my mind essential), and as Vasili notes, it's a good ...


16

There exists a business model (I, among others, would call it very dodgy, just short of fraud) where registrars send out letters that look very much like renewal notices for domains that they do NOT handle. When you reply to these notices (which are confusingly similar to regular renewals if you don't read them carefully) that is legally interpreted as a ...


16

DNS records are a hierarchy. Anything at the same level (v1.example.com, v2.example.com, etc) will all be resolved by the NS records set for that level (example.com) You can have different nameservers for different levels / subdomains if you are so inclined, for example (example.com at godaddy, subdomain1.example.com network solutions, subdomain2.example....


15

Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward the authoritative name server(s). The why is probably because with the distributed and delegated nature of DNS it seemed a good idea at the time to include the "...


14

nslookup is quirky and often gives misleading answers. Its authors (ISC) recommend not using it. The standard tool is therefore dig: % dig mydomain.example.com. A .... That will check via your configured recursive resolvers. If you want to check the contents of a specific server, i.e. the name servers for your domain, add @server_name or @server_ip to ...


14

If I'm not mistaken, the problem is that your registrar has published DS records for your domain - that is, DNSSEC signing keys: [me@risby player]$ dig ds ultreyatours.com [...] ;; ANSWER SECTION: ultreyatours.com. 85920 IN DS 49864 8 1 0152C1213569799FAFA42C7699A20132A293F908 ultreyatours.com. 85920 IN DS 20536 8 1 ...


13

There's nothing wrong with having two services go to the same IP address, as long as the destination ports do not conflict with one another. In this case, you would be using port 53 for DNS, and port 80 for your web server. You can also have both (or all) of your nameservers set to the same IP address.* You will need to set up an authoritative DNS ...


12

You'll be happy to know that most (if not all) DNS server software has protection against this scenario. For example: Microsoft DNS server has a MaxCacheTTL setting, which defaults to 86400. So regardless of any TTL setting in DNS RRs, if this is not adjusted, the DNS server will not cache anything longer than a day. BIND also has a similar setting max-...


12

There is nothing you can do to forcibly stop other people from pointing their domains at your server. It may not be malicious; it may be that they have simply made a typo in their zone file, or that they have forgotten to delete an old entry. So the first thing to do is to simply contact them and politely inform them of the error. If they don't respond ...


11

Not necessarily; it means 10 million queries against your authoritative server, which correlates with emails or site visits but doesn't have a direct conversion. So, if two users are using your site and they share a recursive DNS server, only one query needs to occur to cache a record for its TTL; subsequent queries will get the cached copy without querying ...


11

If you are running a public accessible DNS server then other clients may be start using you. Maybe to use you as a public resolver or maybe to abuse your service for an DNS amplification attack. If you are not running a public server and have 127.0.0.1 setup as your resolver on that server: It's most likely queries your applications make to resolve ...


11

I don't have personal experience with the operation of a New gTLD but the answer surely must be that it is possible for you to operate your own nameservers (and other services). I think the question rather is "at what cost", to which I do not have a direct answer. IANA's technical requirements for nameservers appears to be a straightforward technical ...


10

For whatsmydns.net the Token Mismatch error is related to a timeout of a token generated by the website that allows you to use their search/lookup system. Normally you can refresh the whatsmydns.net website to get a new token and perform searches. It appears they use this token to ensure a 3rd party does not use their system and that instead users go to ...


8

Many DNS servers are pre-configured with version information in DNS TXT records for the version.bind label in the CHAOS class. If this is the case with yours as well, you could retreive it by running dig @dns.name.server version.bind chaos txt Typical answers might include ;; ANSWER SECTION: version.bind. 0 CH TXT "9.8.1-P1" or ;...


8

Looks like your domain registration has expired -- cleangreenpgh.com is on Client Hold status. The expiry date is showing as 2015 because they temporarily add a year to an expired domain to give you a chance to renew before it becomes generally available. See the relevant help page here.


8

Google Domains is a registrar which also offers a DNS service; Google Cloud DNS is a pure cloud-based DNS service, which doesn't handle domain registration but offers higher control and more features on the service itself. When you register a domain, there are two steps involved: the actual registration and the handling of the DNS service for the domain. ...


7

DNS record lifetimes are based on the TTL (Time To Live) of the record itself. If the TTL is 1 hour then theoretically that's the maximum amount of time a DNS resolver will cache that information before it performs a new lookup for the record. Typically this would only affect DNS resolvers that already have the information in their resolver cache. Any ...


7

Your first record ("blank"/apex/root) can, but probably shouldn't, be a cname; see How to overcome root domain CNAME restrictions? on Stack Overflow: This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other resources ...


7

Zone files on slave DNS servers often do not (and should not) have information to this hidden master DNS server. They can have A records in their zone files to point to this hidden DNS master server. The server is called "hidden" not because no one can ever know about it, but because it's not listed anywhere using NS records so clients can't query them. ...


6

DNS can very well be used for load balancing, but it's only able to do things like simple round robin. If you want to implement something like a high availability solution in DNS, you'll have to disable IPs that are unavailable, for which you would need to set the TTL to some minimum value, which is not a good idea. In general its a much better idea to use ...


6

DNSMasq does this nicely. It is a pretty light weight DNS server. A config that looks like this might be close to what you want. # go.com requests server=/go.com/192.95.16.109 # all other requests server=8.8.8.8 server=8.8.4.4


6

You can use the dig utility from dns-utils (packaged with bind usually), and use the +trace option. Output Your dns servers seem to be "dns200.anycast.me" and "ns200.anycast.me". Is this correct? They returned no response, so start looking there. If you've changed DNS server addresses, the change can take some time to propagate (in my experience, up to ...


6

The technology you are looking for is called Anycast. http://en.wikipedia.org/wiki/Anycast Anycast is a network addressing and routing methodology in which datagrams from a single sender are routed to the topologically nearest node in a group of potential receivers, though it may be sent to several nodes, all identified by the same destination ...


6

These lines are your problem: MYSITE.com. IN NS ns.MYSITE.com MYSITE.com. IN NS ns2.MYSITE.com You need to canonicalise them to stop the domain being reappended: MYSITE.com. IN NS ns.MYSITE.com. MYSITE.com. IN NS ns2.MYSITE.com. This is not the place to ask to be taught about glue records; wikipedia them and read up.


6

You'll be fine so long as you claim ownership of the domain at DigitalOcean (i.e. associate it with your account) before you tell the registrar to use their name servers. If someone has associated your domain with their account already you'll find out before the DigitalOcean nameservers become authoritative. And if that happens, talk to DigitalOcean ...


6

This being a 'government domain name' is not a factor. It works just like other domains. The mpwt.gov.la zone is not delegated to ns101.ovh.net but rather as seen below: mpwt.gov.la. 3600 IN NS ns2.lanic.gov.la. mpwt.gov.la. 3600 IN NS ns3.lanic.gov.la. mpwt.gov.la. 3600 IN NS ns1....


6

The empty response that you're looking at is a synthetic state known as NODATA. NODATA and NXDOMAIN both indicate that the name does not exist, but NXDOMAIN applies to all names beneath the indicated record as well. NODATA is advising that either that name is associated with records of an unrequested type, or that there are other records that are beneath ...


Only top voted, non community-wiki answers of a minimum length are eligible