Hot answers tagged

34

In short, you can't make the @ record a CNAME without deleting all other resource records for @, and you can't do that since some (like the NS records) are required for proper DNS functionality. This is one reason why providers such as Heroku tell you not to use naked domain names. You will need a host to perform the HTTP redirection from example.com to www....


28

You can't. ELB provides one -- or more -- IP addresses, hiding behind the CNAME you are using with www record, and these addresses are not static, so you can't create an A record at the top ("apex") of your domain and point to the addresses... along with that, a CNAME at the apex of a domain is not a valid DNS configuration. So there isn't directly a way ...


22

Your hosting provider who owns the IP sets the PTR record for it. There is nothing to do in the DNS zone editor for your domain. I have just done it. My hosting provider (digitalocean) automatically created PTR record when I named the host, it just needed to be the full name, ending with the domain. I added the IP in Godaddy's DNS editor. Now nslookup ...


21

To make things nice and clear, as some of the GoDaddy help articles are dead wrong: You just need to paste the two records from the server settings into your Route 53 control panel as a new record. The possible deception here is the the GD email panel will tell you you're wrong, but not what is right so you can make it right. Further, their help article ...


14

If I'm not mistaken, the problem is that your registrar has published DS records for your domain - that is, DNSSEC signing keys: [me@risby player]$ dig ds ultreyatours.com [...] ;; ANSWER SECTION: ultreyatours.com. 85920 IN DS 49864 8 1 0152C1213569799FAFA42C7699A20132A293F908 ultreyatours.com. 85920 IN DS 20536 8 1 ...


12

gd_bundle-g2-g1.crt: Go Daddy Certificate Bundles - G2 With Cross to G1, includes Root gdig2.crt: Go Daddy Secure Server Certificate (Intermediate Certificate) - G2 2b9918dccf2f1d.crt: Your certificate Source: https://certs.godaddy.com/anonymous/repository.pki


10

Two things you can do: Verify the intermediate chain Clean up the intermediate chain Verify the intermediate chain As the error seems to indicate, there is something off about your intermediate certificate chain. You should check where you got your certificate from and that you got the correct intermediate bundle. You should verify the "hash" and "issuer'...


9

I really wouldn't recommend hosting DNS with Godaddy if you depend on having your site available 99.99% of the time. Godaddy has pretty much the worst uptime around Godady has an uptime of 99.966 http://uptime.besthostratings.com/viewreport.php?host=GoDaddy Compared to Amazon Route 53, which has an uptime of 99.9978 http://blog.cloudharmony.com/2012/08/...


8

In addition to the accepted answer, another option is to create an AWS hosted zone in AWS Route 53 following the steps below: Sign in to the AWS Management Console and open the Amazon Route 53 console at https://console.aws.amazon.com/route53/. Choose Create Hosted Zone. You'll need to ensure your hosted zone points to your loadbalancer. To do this, create ...


7

You want to use a CNAME record, something like my.web.thingy.org CNAME my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com. http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-domain-names-with-elb.html [Edit; response to comment]: There is no need for you to set any A record. You just point your name to the ELB name ...


6

As far as I know the majority (all maybe?) of the SSL providers do not add the old certificate to a Certificate Revocation List nor will they respond negatively to an OCPS request when a certificate renewal is requested. In other words, the current certificate will remain valid and you have until the time it expires to roll out the new certificate, ...


6

What you want is called virtual hosting. And it works much better than what you described! Just add multiple server blocks with different server_name and root directories. One server block per domain name. Note that only one of them can be marked as default_server but apart from that all blocks can look identical. The best way to do this is by creating one ...


5

It's possible to create a cert for multiple names without using wild cards, by using Subject Alternative Name. This might be one of those, though it's impossible to tell without looking for it. I would strongly advise you to use SAN and thus have the cert valid for both sites; otherwise some users will get warnings.


5

The file ~/.ssh/config is for SSH client configuration. You cannot disable the SSH daemon from accepting password logins from this file. Off hand, I cannot think of any way to do it in a shared environment where you do not have access to the daemon configuration. Since you are now using key-based authentication, why not set the password to something ...


5

You appear to have configured multiple A records. The domain points at both 184.168.221.55 (GoDaddy) and 94.23.211.117 (OVH). Delete the GoDaddy record and you should be fine (note: DNS gets cached, so it may take a few minutes to a few hours for it to stop happening). Right now, you've accidentally implemented http://en.wikipedia.org/wiki/Round-robin_DNS.


5

You can achieve this easily using server blocks in Nginx to create multiple 'virtual hosts', each with a different HTTP configuration. This works by Nginx processing your request differently depending on which URL you used to reach the server. Put simply, to reach siteone.com you need to create a server block with a server_name value of siteone.com. Each ...


5

You'll want to replace the two GoDaddy nameservers with the four Route53 ones. To prevent downtime, ensure you have the same records in both GoDaddy and Route53 before making the nameserver changes.


5

The PTR record (also called reverse DNS record) is not located in the domain's zone but in the ARPA's zone, as it relates to the IP address, not the domain name. That record needs to be created by your SMTP server's ISP for its static IP address. That is not something done through Cloudflare, which would be impossible since the IP addresses they use are ...


5

This behavior sounds a lot like an HSTS (https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Security) header was set for the domain. The good news is that you can simply stop applying it and the effects will eventually go away. The bad news is that it’s usually set to at least six months, and the only way to stop it earlier is to have all clients clear ...


4

I do not agree that this is a bad idea, it's no different from any other complex domain name. However, you will need to have multiple DNS zones which would be operating system dependent. I was able to successfully achieve this on a VPS running cPanel using the following steps: Have a control panel for each subdomain (these do not need to be on the same ...


4

Recently switched from GoDaddy (was a client for almost 5 years of their DNS and domain registration services) to Route 53. Why GoDaddy was better for me than Route53: they do not charge you for DNS queries; they provide a free mail forwarding service. That's it. Now why Route53 is better than GoDaddy: a better UI (GoDaddy's UI is really confusing); API;...


4

A quick look at dig for your zones doesn't show anything glaringly wrong with your DNS configuration, which leads me to believe that this is a web server configuration issue. If I had to guess, I'd say that you have a binding in IIS for the site in question that will only serve pages if the request comes to www.midwestcointrader.com. You should add ...


4

You're missing the certificate chain. Follow GoDaddy's Instructions, make sure you install their Intermediate certificates (commonly called a chain, or bundle as well) GoDaddy supports Internet Censorship. You should seriously reconsider funding them. Especially when you can get SSL Certificates for Free. For Apache 2.2.x, you need all three of the ...


4

You have entered the wrong IP address in your SPF record. Here's the current record: littlejawsbigsmiles.com. 3600 IN TXT "v=spf1 a mx ptr ip4:72.167.234.245 -all" Here's the IP you're sending from: 72.167.234.239 Which is clearly different from 72.167.234.245. Fix the record so that there's no mistake in it and everything should work fine. ...


4

If whynopadlock.com and ssltest.net complain about the certificate while ssllabs.com say that things are fine, check your virtual hosts configuration. SSLLabs.com supports SNI while whynopadlock.com, ssltest.net and older versions of IE do not. When SNI is not supported by the client, no server name will be available to the webserver which will then ...


4

You can use openssl's x509 subcommand: openssl x509 -subject -issuer -noout -in cert.pem and check the output. Should be self explanatory. An example: $ openssl x509 -noout -issuer -subject -in gd-class2-root.crt issuer= /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority subject= /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy ...


4

You're prematurely optimizing. Do you really think DNS lookups are the slowest part of your entire website? I just did some tests against my own Wordpress site. The DNS lookup took 0.008s, while retrieving the actual body of the page took 0.072s. Pulling down the page is nine times slower, and my web server is cached by Varnish and using a static site ...


4

According to WPEngine, you just need a CNAME record pointing at your wpengine address. See this for instructions (directly from WPEngine, actually).


4

problem is that when you renewed the certificate, you accepted the default encryption method of SHA2 which is not supported properly yet. Needed to switch it to SHA1. SHA1 used to be the default but has recently changed. Something to be aware of going forward. by default, godaddy now issues certificates in the higher new format. You can re-issue the ...


Only top voted, non community-wiki answers of a minimum length are eligible