dig output missing answer sectionCentOS BIND DNS Troubleshooting?DNS setup with BINDGlobal Reverse DNS look-ups not workingDNS lookup failure while configuration is okayHow to correctly configure nameserversHow do I Delegate a subdomain to Route53Ubuntu uses external DNS to resolve localhostdns lookup at different dns serversServer 2012R2 DNS server returning SERVFAIL for some AAAA queriesDNS server with bind in Debian 9
Why is C# in the D Major Scale?
What happens if I start too many background jobs?
How to give very negative feedback gracefully?
Point of the the Dothraki's attack in GoT S8E3?
How do I tell my manager that his code review comment is wrong?
Pawn Promotion Double Checks
Type-check an expression
If 1. e4 c6 is considered as a sound defense for black, why is 1. c3 so rare?
Transpose of product of matrices
Airbnb - host wants to reduce rooms, can we get refund?
How can I support myself financially as a 17 year old with a loan?
Does a wine bottle stopper require tevillah?
What happens to matryoshka Mordenkainen's Magnificent Mansions?
Do I really need diodes to receive MIDI?
How did Arya get her dagger back from Sansa?
Can't remove one character of space in my environment
Virus Detected - Please execute anti-virus code
In a Latex Table, how can I automatically resize cell heights to account for superscripts?
Would glacier 'trees' be plausible?
What does a yield inside a yield do?
Is Cola "probably the best-known" Latin word in the world? If not, which might it be?
Why is `abs()` implemented differently?
Returning the outputs of a nested structure
What was the state of the German rail system in 1944?
dig output missing answer section
CentOS BIND DNS Troubleshooting?DNS setup with BINDGlobal Reverse DNS look-ups not workingDNS lookup failure while configuration is okayHow to correctly configure nameserversHow do I Delegate a subdomain to Route53Ubuntu uses external DNS to resolve localhostdns lookup at different dns serversServer 2012R2 DNS server returning SERVFAIL for some AAAA queriesDNS server with bind in Debian 9
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I recently got a new domain (lets call it testdomain.extample) from Route53 on Amazon. I further have a classic load balancer from AWS that I want requests to be forwarded to when somebody visits www.testdomain.example.
Under hosted zones on Route53 I went over instructions to set NS, SOA (Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA). I also added an A type record and added my load balancer (from a dropdown) to it as specified in the documentation.
When I run dig on my domain this is what I see (I don't see an answer section as I see for other working websites). It is about 12 hours since I updated on AWS. The browser shows "server IP address could not be found." error. Is there something I am missing in all of this?
>>> dig www.mytestdomain.example
; <<>> DiG 9.10.6 <<>> www.mytestdomain.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.mytestdomain.example. IN A
;; Query time: 161 msec
;; SERVER: 192.0.2.75#53(192.0.2.75)
;; WHEN: Tue Apr 23 05:44:21 PDT 2019
;; MSG SIZE rcvd: 52
domain-name-system load-balancing amazon-route53 dig
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
asked Apr 23 at 12:49
user2399453user2399453
991
add a comment |
I recently got a new domain (lets call it testdomain.extample) from Route53 on Amazon. I further have a classic load balancer from AWS that I want requests to be forwarded to when somebody visits www.testdomain.example.
Under hosted zones on Route53 I went over instructions to set NS, SOA (Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA). I also added an A type record and added my load balancer (from a dropdown) to it as specified in the documentation.
When I run dig on my domain this is what I see (I don't see an answer section as I see for other working websites). It is about 12 hours since I updated on AWS. The browser shows "server IP address could not be found." error. Is there something I am missing in all of this?
>>> dig www.mytestdomain.example
; <<>> DiG 9.10.6 <<>> www.mytestdomain.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.mytestdomain.example. IN A
;; Query time: 161 msec
;; SERVER: 192.0.2.75#53(192.0.2.75)
;; WHEN: Tue Apr 23 05:44:21 PDT 2019
;; MSG SIZE rcvd: 52
domain-name-system load-balancing amazon-route53 dig
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
asked Apr 23 at 12:49
user2399453user2399453
991
2
"Is there something I am missing in all of this? " 1) Do not (badly, I edited your post) obfuscate names and IP addresses, this makes basically anyone unable to help you 2) a browser is useless to test DNS resolution problems,digis fine but 3) when usingdigALWAYS specify (with its@flag) which nameserver you query because with that 4) "It is about 12 hours since I updated on AWS." there is no need to wait, if you query the authoritative nameservers on your domain the changes should appear immediately.
– Patrick Mevzek
Apr 23 at 23:58
2
Based on "Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA" - which seems to surprise you - I am guessing you may have forgotten an important step: you need, through your registrar, to update your domain so that it has the relevant nameservers (the ones added by your provider) as authoritative on it and to be published on the parent zone, controlled by the registry (which is why you need to go through your registrar). Until you do that, direct queries to the authoritative nameservers may work but basically the domain will not globally as there is no "link" from parent.
– Patrick Mevzek
Apr 24 at 0:00
1
2 useful online debugging tool that may give you better explanations: zonemaster.net and dnsviz.net. Use them extensively, specifically if you do not masterdigparameters and output.
– Patrick Mevzek
Apr 24 at 0:00
Thanks for the helpful comments. I got closer to understanding the problem after doing some experiments. I think the issue is that I had deleted the hosted zone in between and recreated it in route 53. When I do dig +trace I see 4 NS entries that do not match what I have set in R53 on AWS. However if I use the NS entry in AWS to do a dig @ then it correctly routes to my load balancer. So the question then is how do I fix the bad NS entries that seem to be outside AWS? Is it something that propagates and updates over time?
– user2399453
Apr 24 at 6:54
add a comment |
I recently got a new domain (lets call it testdomain.extample) from Route53 on Amazon. I further have a classic load balancer from AWS that I want requests to be forwarded to when somebody visits www.testdomain.example.
Under hosted zones on Route53 I went over instructions to set NS, SOA (Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA). I also added an A type record and added my load balancer (from a dropdown) to it as specified in the documentation.
When I run dig on my domain this is what I see (I don't see an answer section as I see for other working websites). It is about 12 hours since I updated on AWS. The browser shows "server IP address could not be found." error. Is there something I am missing in all of this?
>>> dig www.mytestdomain.example
; <<>> DiG 9.10.6 <<>> www.mytestdomain.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.mytestdomain.example. IN A
;; Query time: 161 msec
;; SERVER: 192.0.2.75#53(192.0.2.75)
;; WHEN: Tue Apr 23 05:44:21 PDT 2019
;; MSG SIZE rcvd: 52
domain-name-system load-balancing amazon-route53 dig
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
asked Apr 23 at 12:49
user2399453user2399453
991
I recently got a new domain (lets call it testdomain.extample) from Route53 on Amazon. I further have a classic load balancer from AWS that I want requests to be forwarded to when somebody visits www.testdomain.example.
Under hosted zones on Route53 I went over instructions to set NS, SOA (Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA). I also added an A type record and added my load balancer (from a dropdown) to it as specified in the documentation.
When I run dig on my domain this is what I see (I don't see an answer section as I see for other working websites). It is about 12 hours since I updated on AWS. The browser shows "server IP address could not be found." error. Is there something I am missing in all of this?
>>> dig www.mytestdomain.example
; <<>> DiG 9.10.6 <<>> www.mytestdomain.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.mytestdomain.example. IN A
;; Query time: 161 msec
;; SERVER: 192.0.2.75#53(192.0.2.75)
;; WHEN: Tue Apr 23 05:44:21 PDT 2019
;; MSG SIZE rcvd: 52
domain-name-system load-balancing amazon-route53 dig
domain-name-system load-balancing amazon-route53 dig
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
asked Apr 23 at 12:49
user2399453user2399453
991
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
asked Apr 23 at 12:49
user2399453user2399453
991
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
edited Apr 23 at 23:56
Patrick Mevzek
2,99231225
2,99231225
asked Apr 23 at 12:49
user2399453user2399453
991
asked Apr 23 at 12:49
user2399453user2399453
991
asked Apr 23 at 12:49
user2399453user2399453
991
991
2
"Is there something I am missing in all of this? " 1) Do not (badly, I edited your post) obfuscate names and IP addresses, this makes basically anyone unable to help you 2) a browser is useless to test DNS resolution problems,digis fine but 3) when usingdigALWAYS specify (with its@flag) which nameserver you query because with that 4) "It is about 12 hours since I updated on AWS." there is no need to wait, if you query the authoritative nameservers on your domain the changes should appear immediately.
– Patrick Mevzek
Apr 23 at 23:58
2
Based on "Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA" - which seems to surprise you - I am guessing you may have forgotten an important step: you need, through your registrar, to update your domain so that it has the relevant nameservers (the ones added by your provider) as authoritative on it and to be published on the parent zone, controlled by the registry (which is why you need to go through your registrar). Until you do that, direct queries to the authoritative nameservers may work but basically the domain will not globally as there is no "link" from parent.
– Patrick Mevzek
Apr 24 at 0:00
1
2 useful online debugging tool that may give you better explanations: zonemaster.net and dnsviz.net. Use them extensively, specifically if you do not masterdigparameters and output.
– Patrick Mevzek
Apr 24 at 0:00
Thanks for the helpful comments. I got closer to understanding the problem after doing some experiments. I think the issue is that I had deleted the hosted zone in between and recreated it in route 53. When I do dig +trace I see 4 NS entries that do not match what I have set in R53 on AWS. However if I use the NS entry in AWS to do a dig @ then it correctly routes to my load balancer. So the question then is how do I fix the bad NS entries that seem to be outside AWS? Is it something that propagates and updates over time?
– user2399453
Apr 24 at 6:54
add a comment |
2
"Is there something I am missing in all of this? " 1) Do not (badly, I edited your post) obfuscate names and IP addresses, this makes basically anyone unable to help you 2) a browser is useless to test DNS resolution problems,digis fine but 3) when usingdigALWAYS specify (with its@flag) which nameserver you query because with that 4) "It is about 12 hours since I updated on AWS." there is no need to wait, if you query the authoritative nameservers on your domain the changes should appear immediately.
– Patrick Mevzek
Apr 23 at 23:58
2
Based on "Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA" - which seems to surprise you - I am guessing you may have forgotten an important step: you need, through your registrar, to update your domain so that it has the relevant nameservers (the ones added by your provider) as authoritative on it and to be published on the parent zone, controlled by the registry (which is why you need to go through your registrar). Until you do that, direct queries to the authoritative nameservers may work but basically the domain will not globally as there is no "link" from parent.
– Patrick Mevzek
Apr 24 at 0:00
1
2 useful online debugging tool that may give you better explanations: zonemaster.net and dnsviz.net. Use them extensively, specifically if you do not masterdigparameters and output.
– Patrick Mevzek
Apr 24 at 0:00
Thanks for the helpful comments. I got closer to understanding the problem after doing some experiments. I think the issue is that I had deleted the hosted zone in between and recreated it in route 53. When I do dig +trace I see 4 NS entries that do not match what I have set in R53 on AWS. However if I use the NS entry in AWS to do a dig @ then it correctly routes to my load balancer. So the question then is how do I fix the bad NS entries that seem to be outside AWS? Is it something that propagates and updates over time?
– user2399453
Apr 24 at 6:54
2
2
"Is there something I am missing in all of this? " 1) Do not (badly, I edited your post) obfuscate names and IP addresses, this makes basically anyone unable to help you 2) a browser is useless to test DNS resolution problems,
dig is fine but 3) when using dig ALWAYS specify (with its @ flag) which nameserver you query because with that 4) "It is about 12 hours since I updated on AWS." there is no need to wait, if you query the authoritative nameservers on your domain the changes should appear immediately.– Patrick Mevzek
Apr 23 at 23:58
"Is there something I am missing in all of this? " 1) Do not (badly, I edited your post) obfuscate names and IP addresses, this makes basically anyone unable to help you 2) a browser is useless to test DNS resolution problems,
dig is fine but 3) when using dig ALWAYS specify (with its @ flag) which nameserver you query because with that 4) "It is about 12 hours since I updated on AWS." there is no need to wait, if you query the authoritative nameservers on your domain the changes should appear immediately.– Patrick Mevzek
Apr 23 at 23:58
2
2
Based on "Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA" - which seems to surprise you - I am guessing you may have forgotten an important step: you need, through your registrar, to update your domain so that it has the relevant nameservers (the ones added by your provider) as authoritative on it and to be published on the parent zone, controlled by the registry (which is why you need to go through your registrar). Until you do that, direct queries to the authoritative nameservers may work but basically the domain will not globally as there is no "link" from parent.
– Patrick Mevzek
Apr 24 at 0:00
Based on "Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA" - which seems to surprise you - I am guessing you may have forgotten an important step: you need, through your registrar, to update your domain so that it has the relevant nameservers (the ones added by your provider) as authoritative on it and to be published on the parent zone, controlled by the registry (which is why you need to go through your registrar). Until you do that, direct queries to the authoritative nameservers may work but basically the domain will not globally as there is no "link" from parent.
– Patrick Mevzek
Apr 24 at 0:00
1
1
2 useful online debugging tool that may give you better explanations: zonemaster.net and dnsviz.net. Use them extensively, specifically if you do not master
dig parameters and output.– Patrick Mevzek
Apr 24 at 0:00
2 useful online debugging tool that may give you better explanations: zonemaster.net and dnsviz.net. Use them extensively, specifically if you do not master
dig parameters and output.– Patrick Mevzek
Apr 24 at 0:00
Thanks for the helpful comments. I got closer to understanding the problem after doing some experiments. I think the issue is that I had deleted the hosted zone in between and recreated it in route 53. When I do dig +trace I see 4 NS entries that do not match what I have set in R53 on AWS. However if I use the NS entry in AWS to do a dig @ then it correctly routes to my load balancer. So the question then is how do I fix the bad NS entries that seem to be outside AWS? Is it something that propagates and updates over time?
– user2399453
Apr 24 at 6:54
Thanks for the helpful comments. I got closer to understanding the problem after doing some experiments. I think the issue is that I had deleted the hosted zone in between and recreated it in route 53. When I do dig +trace I see 4 NS entries that do not match what I have set in R53 on AWS. However if I use the NS entry in AWS to do a dig @ then it correctly routes to my load balancer. So the question then is how do I fix the bad NS entries that seem to be outside AWS? Is it something that propagates and updates over time?
– user2399453
Apr 24 at 6:54
add a comment |
1 Answer
1
active
oldest
votes
There is no answer section because your query went unanswered,
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
^^^^^^^^
check the status section: the name server returned an error code and you get the SERVFAIL error response. That is typically the result of a nameserver or your zone not having been configured correctly.
Note: In many cases it may be necessary to know the actual domain name in order to answer DNS questions. See What information should I include or obfuscate in my posts?
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
1
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964219%2fdig-output-missing-answer-section%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
There is no answer section because your query went unanswered,
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
^^^^^^^^
check the status section: the name server returned an error code and you get the SERVFAIL error response. That is typically the result of a nameserver or your zone not having been configured correctly.
Note: In many cases it may be necessary to know the actual domain name in order to answer DNS questions. See What information should I include or obfuscate in my posts?
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
1
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
add a comment |
There is no answer section because your query went unanswered,
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
^^^^^^^^
check the status section: the name server returned an error code and you get the SERVFAIL error response. That is typically the result of a nameserver or your zone not having been configured correctly.
Note: In many cases it may be necessary to know the actual domain name in order to answer DNS questions. See What information should I include or obfuscate in my posts?
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
1
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
add a comment |
There is no answer section because your query went unanswered,
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
^^^^^^^^
check the status section: the name server returned an error code and you get the SERVFAIL error response. That is typically the result of a nameserver or your zone not having been configured correctly.
Note: In many cases it may be necessary to know the actual domain name in order to answer DNS questions. See What information should I include or obfuscate in my posts?
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
There is no answer section because your query went unanswered,
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3567
^^^^^^^^
check the status section: the name server returned an error code and you get the SERVFAIL error response. That is typically the result of a nameserver or your zone not having been configured correctly.
Note: In many cases it may be necessary to know the actual domain name in order to answer DNS questions. See What information should I include or obfuscate in my posts?
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
edited Apr 23 at 12:58
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
answered Apr 23 at 12:53
HBruijnHBruijn
57.3k1190152
57.3k1190152
1
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
add a comment |
1
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
1
1
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
"That is typically the result of a nameserver or your zone not having been configured correctly. " or a DNSSEC related problem. Which indeed is impossible to separate between the two because the OP badly and unnecessarily obfuscated the name.
– Patrick Mevzek
Apr 23 at 23:54
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964219%2fdig-output-missing-answer-section%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
"Is there something I am missing in all of this? " 1) Do not (badly, I edited your post) obfuscate names and IP addresses, this makes basically anyone unable to help you 2) a browser is useless to test DNS resolution problems,
digis fine but 3) when usingdigALWAYS specify (with its@flag) which nameserver you query because with that 4) "It is about 12 hours since I updated on AWS." there is no need to wait, if you query the authoritative nameservers on your domain the changes should appear immediately.– Patrick Mevzek
Apr 23 at 23:58
2
Based on "Amazon adds a bunch of ns-xxx.* hostnames for NS and one for SOA" - which seems to surprise you - I am guessing you may have forgotten an important step: you need, through your registrar, to update your domain so that it has the relevant nameservers (the ones added by your provider) as authoritative on it and to be published on the parent zone, controlled by the registry (which is why you need to go through your registrar). Until you do that, direct queries to the authoritative nameservers may work but basically the domain will not globally as there is no "link" from parent.
– Patrick Mevzek
Apr 24 at 0:00
1
2 useful online debugging tool that may give you better explanations: zonemaster.net and dnsviz.net. Use them extensively, specifically if you do not master
digparameters and output.– Patrick Mevzek
Apr 24 at 0:00
Thanks for the helpful comments. I got closer to understanding the problem after doing some experiments. I think the issue is that I had deleted the hosted zone in between and recreated it in route 53. When I do dig +trace I see 4 NS entries that do not match what I have set in R53 on AWS. However if I use the NS entry in AWS to do a dig @ then it correctly routes to my load balancer. So the question then is how do I fix the bad NS entries that seem to be outside AWS? Is it something that propagates and updates over time?
– user2399453
Apr 24 at 6:54