3

Domain resolves fine on other ISPs and in Google DNS (8.8.8.8) however there's this one ISP that suddenly is having issues on a server where we host our domains.

When I gave them some sample domains, they were able to fix it but the rest of the domains that I didn't mention still wasn't resolving. So I think they only did a "manual" bandaid fix (maybe kinda like manually editing the IPs in your Windows hosts file, not sure, hopefully not).

I want to them fix the issue properly. I'm not sure what's going on their end but it gives me the impression they are clueless about the real cause of the problem since the other domains that I didn't mention are not resolving.

Ideally, what troubleshooting steps should they take on their end to properly fix the issue?

  • Try comparing dig +trace yourdomain.com and dig @8.8.8.8 +trace yourdomain.com when connected to the problematic ISP. That should give a hint on where did the DNS resolution stop. – Marek Rost Feb 15 '18 at 12:58
  • @MarekRost I gather that's a Linux command, any Windows equivalent? – IMB Feb 15 '18 at 15:38
  • 1
    Have you gotten on the phone with your ISP and press to talk with the highest level DNS administrator of their operation center and try to get someone with high knowledge of DNS configuration and infrastructure on their side to help troubleshoot this issue with their DNS system? I think a step you take is to be demanding, they are an ISP, they have admins or they can hire a consultant. If it's interrupting your service, pressure them harder and make them do their work. Once you verify it's not on your end, make it their problem to help resolve. Be a little more demanding & assertive perhaps. – Pimp Juice IT Feb 18 '18 at 15:57
  • 1
    I don't trust India any more than your ISP. It seems to mean that the DNS works, as long as one communicates from outside the domain of your ISP. It seems funny, because normally the same mechanism should be used for all DNS queries. My guess is that the problem is with some cache that your ISP keeps for its own clients or for users of your country. You can check further by going through some VPN that has its server in another country and see if the problem still happens. If you managed to get dig working on Windows or live Linux, post the information if you want more than a guess. – harrymc Feb 19 '18 at 11:11
  • 1
    My guess is that the bad record, maybe a glue record, has just stayed there, so when you undid the change it started causing the same problem again. But hey, you may now have a workaround to the problem, even if your clueless ISP can't help. – harrymc Feb 19 '18 at 20:33
1
+50

I base my answer on the following facts :

  • Calling dig mydomain.com gets connection timed out; no servers could be reached, but dig +trace mydomain.com gets the expected result.

  • Changing the name-server of a domain server and setting an A record with its IP worked. Reverting the name-server back to the original stopped working again.

My explanation is that there a wrong glue record pointing to a wrong IP for your name-server. Only DNS queries that require an authoritative response and don't use glue records get the right response.

A DNS query to look up the IP address of example.com would only get the name-server, say ns1.example.com. But then sending a query to ns1.example.com needs its IP address, for which one needs to ask its parent, example.com, and away we go again until the browser decides that no connection is possible. The glue record tells the name-server of example.com the IP of ns1.example.com, so it can return it immediately.

My theory is that a glue record for your domain contains a wrong IP address for your name-server so no contact can be established with it. Only DNS queries that ask for an authoritative response will work, apparently because such queries bypass glue records.

You may now have a workaround to the problem, even if your ISP can't help, by changing the name-server of your domain server and abandoning the one botched by your ISP.

References :

  • To clarify, is the glue record to be fixed on the ISP side or is it to be fixed on the domain registrar's DNS Manager (e.g., Godaddy)? – IMB Feb 21 '18 at 9:00
  • It's maintained by the owner of the DNS server, usually your ISP. – harrymc Feb 21 '18 at 9:47
  • Have you advanced in solving the problem ? – harrymc Feb 24 '18 at 7:07
  • I have not heard back from the ISP admins yet but I did mention the possible glue record issue. – IMB Feb 24 '18 at 7:17
  • It's frustrating when the people charged with keeping your data are not professionally apt, but at least you have a workaround. – harrymc Feb 24 '18 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.