63 votes
Accepted

Can someone using the same DNS server as me hijack my domains?

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @...
  • 32.4k
49 votes
Accepted

Do I need a separate SSL certificate for a DNS redirect?

The certificate name must match what the user entered in the browser, not the 'final' DNS record. If the user enters docs.tenantcompany.com then your SSL certificate has to cover that. If docs....
  • 4,935
32 votes

Can someone using the same DNS server as me hijack my domains?

In addition to Wesley's excellent answer, I'd like to add that there is already a solution to prevent this. It's called DNSSEC. The basics are this: You register your domain (I'll go with the ...
  • 27.4k
29 votes

Do I need a separate SSL certificate for a DNS redirect?

Jason's answer is correct. But just to clarify terms a bit here, "DNS redirect" is a bit of a misnomer. DNS has CNAME records (a.k.a. aliases) which is a name pointing to another name. But it's not a ...
  • 16.5k
16 votes
Accepted

Is it possible to combine DNS name servers?

DNS records are a hierarchy. Anything at the same level (v1.example.com, v2.example.com, etc) will all be resolved by the NS records set for that level (example.com) You can have different ...
  • 15.5k
15 votes
Accepted

Why send authoritative nameserver in DNS?

Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward ...
  • 73k
14 votes
Accepted

Setting sub domain DNS to route default port 80 to custom port

For general HTTP purposes (web browsing, etc.), DNS cannot be used to direct a browser to use a specific port. Browsers are hard-codes to assume 80 for HTTP and 443 for HTTPS. You "could" host ...
  • 656
13 votes
Accepted

How to set SOA Expire Value?

The expire field in a SOA record is the upper limit, in seconds, that your secondary name servers are allowed to use the data before it expires for lack of getting a refresh. You normally do want this ...
  • 73k
13 votes
Accepted

Does a multi-level hostname makes a practical difference?

There will be potentially be an extra delay as creating a separate zone for the world.example.com subdomain typically also implies delegation to different authoritative name servers. If the same ...
  • 73k
12 votes
Accepted

How can I manage all of my domains with minimal configuration?

Unless I'm misunderstanding the question, I do this regularly with BIND, and it seems to be fine as long as each zone is absolutely identical. On my primary nameserver, I have named.conf entries that ...
  • 78.7k
12 votes
Accepted

Is there a standard time duration before DNS caches are cleared?

You'll be happy to know that most (if not all) DNS server software has protection against this scenario. For example: Microsoft DNS server has a MaxCacheTTL setting, which defaults to 86400. So ...
12 votes
Accepted

Changing A record and CNAME records

As mentioned in the comments, you will need to use A records instead of CNAME records. CNAME records will not be able to point at an IP Address. The key to making each of the sites to work is to ...
  • 1,375
12 votes

Moving many sites to new server - whats the quickest way to update their DNS records?

The term you're looking for is CNAME, and the answer to your question is both yes and no. First, here's an example of how a CNAME works in a zone file. example.se IN SOA ns1.example.se. ...
  • 27.4k
11 votes

Changing A record and CNAME records

Use A record to point to the sub domains myurl.com. A 300 123.123.123.123 api.myurl.com. A 300 123.123.123.123 app.myurl.com. A 300 123.123.123.123 preview.myurl.com. A 300 123.123.123....
10 votes
Accepted

DNS errors after changing nameservers for Cloudflare

The error messages and the referenced RFC2181 5.4.1 pretty much already tells what's wrong: you are having conflicting NS records in your zone and in the parent zone as "glue" records. "Glue" above ...
  • 43.6k
10 votes
Accepted

What happens when two DNS zones intersect on the same server?

When overlapping zones are defined on an authoritative nameserver, the most specific zone is used to provide the answer. A query of example.com. IN A? hits the example.com zone. A query of foo....
  • 32k
10 votes

Do I need a separate SSL certificate for a DNS redirect?

I wanted to understand if I my tenant company has a wildcard SSL certificate, will it work with this setup or a new SSL certificate has to be purchased for docs.tenantcompany.com? Short answer: No. ...
10 votes

What are Top level domain server in DNS.Wants to understand its significance in real time network traffic

I used to work for a domain registry and was part of IETF DNS workgroups, so I'll give you a primer. The Domain Name System is designed in a hierarchy. When you look up the data for a domain name, you ...
  • 153
9 votes
Accepted

why bind9 gives connection refused for permission denied error when it is 777

You have the error right there in your output: Feb 8 09:37:24 aname kernel: [1984823.682079] type=1400 audit(1454924244.439:45): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/...
  • 3,403
9 votes

Find out which DNS server answered your query

See this https://stackoverflow.com/questions/38021/how-do-i-find-the-authoritative-name-server-for-a-domain-name in short, nslookup set the query type to SOA single line: nslookup -querytype=soa ...
8 votes
Accepted

Why dig NS returns nothing for a domain while it can find an A record for that domain?

It works as expected. The incorrect assumption here is that all names should have NS records. Instead, the set of nameservers is defined on a per zone basis, with NS records at the zone apex only. ...
8 votes

Does a multi-level hostname makes a practical difference?

Technically, as I understand DNS, only the hello part is considered the host name, the rest is the domain name. As such, it resolves the same way, in your case the DNS zone includes both the example....
  • 3,386
7 votes
Accepted

Missing nameservers reported by parent and your nameservers

The nameservers currently listed at the .pt top level registry are ns1.esoterica.com and ns2.esoterica.com. When I query those two servers, neither of them has any information about your domain, so ...
  • 27.4k
7 votes
Accepted

Why do I need to escape ; with \ in a DNS DKIM record?

The choice of what characters are special and require escaping would depend on the nameserver being used as well as what interface is being used to configure the nameserver (for instance if you're ...
  • 19.3k
7 votes

Can someone using the same DNS server as me hijack my domains?

You'll be fine so long as you claim ownership of the domain at DigitalOcean (i.e. associate it with your account) before you tell the registrar to use their name servers. If someone has associated ...
  • 5,816
7 votes

How to do "dynamic apex" right in DNS/BIND?

I'm the guy who wrote the Q&A that was linked to in the comments, so suffice it to say I've spent some time studying the brain damage surrounding attempts to "make this work". This is basically a ...
  • 32k
7 votes

How do I change reverse DNS on Google Cloud Compute?

Google won't configure reverse DNS for you If you had a carrier such as AT&T or an EC2 instance, they offer reverse DNS services. As of now, Google does not offer this as an attribute of their ...
  • 1,103
7 votes

How to concatenate DNS TXT records?

Just add another TXT record. You can have more than one. concatenating would make them both invalid, they need to stay separate.
6 votes
Accepted

Why is my NS record ns.mysite.com.mysite.com?

These lines are your problem: MYSITE.com. IN NS ns.MYSITE.com MYSITE.com. IN NS ns2.MYSITE.com You need to canonicalise them to stop the domain being reappended: MYSITE.com. IN NS ns.MYSITE.com. ...
  • 78.7k
6 votes

Setting different NS records as authoritative on authoritative DNS

There are really two questions being asked here, and they directly contradict each other: how do I instruct DNS servers to continue their query on to Amazon as its authoritative for the domain, ...
  • 32k

Only top scored, non community-wiki answers of a minimum length are eligible