On Tue, Apr 20, 2010 at 4:17 PM, Carl Raymond <[log in to unmask]> wrote:
> I've been having a strange problem with an external domain name registered
> at GoDaddy, and it keeps getting stranger. About a month ago, we (my
> department) took over management of the domain outreachscholarship.org from
> Penn State. My boss logged into GoDaddy and updated the administrative,
> technical, and billing contacts with his info. We built a fancy new web
> site, and last Monday I logged into GD's DNS management system to update the
> IP address to our web server here at MSU. I was still getting the old IP
> address long after it should have propagated around. As was my boss, and
> his boss. Not good. Several calls into GD show that for them, they see the
> new IP address, but I see the old one.
How long was 'should have propagated around?' What nameservers did
you use? Did you query the authoritative nameserver for your domain?
Did you use dig +trace or a similar tracing command to make sure that
the correct authoritative nameservers for your domain are listed?
Part of the problem with these sorts of problems is that many of them
work themselves out in a number of hours (see results below; which
look fairly normal)
>
> Here's the first weird thing: the tech suggested using a proxy,
> www.megaproxy.com, to bring up the site. When they do that, they see the
> new site. When I do that, I see the old site. How can we both go to the
> same proxy and see something different?
That would depend on how the proxy is configured. Does it use a CDN
to determine where to route your request? All kinds of complications.
But ignore the proxy (and ignore whois for the time being; it is not
relevant.)
PS: I have no idea how much you actually know about DNS, so pardon if
I keep it quite high-level; not trying to insult anyone.
First we need to determine what DNS in general thinks your
authoritative nameservers are. If these are wrong it is likely the
cause of all your problems. DNS is a tree hierarchy, so what we do is
start at the top (the . domain) and ask it "hey where can I find
outreachscholarship.org?" and it will tell us "I dunno, ask .org.,
here is their address" and then we go ask .org. "hey where can I find
outreachscholarship.org" and they say "ns08.domaincontrol.com." Then
we ask "ns08.domaincontrol.com." "hey what is the IP of
"outreachscholarship.org" and they tell us "64.202.189.170".
All that crap is basically covered by the command below. Note that
@8.8.8.8 is Google DNS, which I am using because its a handy IP and I
know it is not totally mis-configured.
antarus@kyoto ~$ dig +trace @8.8.8.8 outreachscholarship.org
; <<>> DiG 9.4.3-P4 <<>> +trace @8.8.8.8 outreachscholarship.org
; (1 server found)
;; global options: printcmd
. 35860 IN NS a.root-servers.net.
. 35860 IN NS b.root-servers.net.
. 35860 IN NS c.root-servers.net.
. 35860 IN NS d.root-servers.net.
. 35860 IN NS e.root-servers.net.
. 35860 IN NS f.root-servers.net.
. 35860 IN NS g.root-servers.net.
. 35860 IN NS h.root-servers.net.
. 35860 IN NS i.root-servers.net.
. 35860 IN NS j.root-servers.net.
. 35860 IN NS k.root-servers.net.
. 35860 IN NS l.root-servers.net.
. 35860 IN NS m.root-servers.net.
;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 58 ms
;; Us asking @8.8.8.8 for for the . server addresses.
org. 172800 IN NS a2.org.afilias-nst.info.
org. 172800 IN NS b2.org.afilias-nst.org.
org. 172800 IN NS a0.org.afilias-nst.info.
org. 172800 IN NS b0.org.afilias-nst.org.
org. 172800 IN NS c0.org.afilias-nst.info.
org. 172800 IN NS d0.org.afilias-nst.org.
;; Received 443 bytes from 192.203.230.10#53(e.root-servers.net) in 40 ms
;; Us asking @e.root-servers.net for .org. server addresses
outreachscholarship.org. 86400 IN NS ns07.domaincontrol.com.
outreachscholarship.org. 86400 IN NS ns08.domaincontrol.com.
;; Received 96 bytes from 199.19.53.1#53(c0.org.afilias-nst.info) in 171 ms
;; Us asking @c0.org.afilias-nst.info for outreachscholarship.org. addresses
outreachscholarship.org. 3600 IN A 64.202.189.170
outreachscholarship.org. 3600 IN NS ns07.domaincontrol.com.
outreachscholarship.org. 3600 IN NS ns08.domaincontrol.com.
;; Received 112 bytes from 216.69.185.4#53(ns07.domaincontrol.com) in 66 ms
;; Us asking @ns07.domaincontrol.com. for the IP address for
outreachscholarship.org. and getting a reply.
We can double check whether ns07.domaincontrol.com thinks it is
Authoritative for outreachscholarship.org by asking it a brief
question.
antarus@kyoto ~$ dig @ns07.domaincontrol.com. outreachscholarship.org a
; <<>> DiG 9.4.3-P4 <<>> @ns07.domaincontrol.com. outreachscholarship.org a
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18761
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;outreachscholarship.org. IN A
;; ANSWER SECTION:
outreachscholarship.org. 3600 IN A 64.202.189.170
;; AUTHORITY SECTION:
outreachscholarship.org. 3600 IN NS ns07.domaincontrol.com.
outreachscholarship.org. 3600 IN NS ns08.domaincontrol.com.
They think they are authoritative for that domain (See the Authority:2
above). If they were serving replies for your domain that were not
marked as Authoritative that would be bad; so we can eliminate that as
a problem.
The TTL for outreachscholariship.org is only 3600 seconds (one hour)
so properly behaved caching DNS nameservers should probably have
purged the old records by now (Servers can basically return existing
records up to TTL seconds, so if you change the record it should take
no longer than TTL seconds to propagate out in a world where all DNS
servers were configured ideally (they are not FYI)). I can't say that
all caching DNS servers are 'properly behaved' and many ignore the TTL
and cache for some random time (24 hours is pretty common.) DNS is a
distributed system which means that there is no 'master database'
where we can just make a DNS change and expect it to show up
everywhere; sometimes it just takes time. There may be third party
services that attempt to track 'how far' a given DNS change has made
it around the internet; however I've never used such a service
(although intriguing in principle.)
In short; these problems are hard to track after the fact precisely
because we do not have heavy introspection into such a distributed
service.
>
> After several calls to GD getting nowhere, we decided to transfer the
> registration to Network Solutions, where we have several other domains
> registered. So we go through the steps to transfer. My boss ends up
> getting a message that says a request for transfer confirmation was sent to
> the administrative contact, which it shows as the old contact at Penn State.
> I did a whois lookup, and see the old Penn State contacts. Aha! The GD
> contact info didn't propagate to the underlying registry back when he
> updated it in March. So I call GD again to ask what to do about that. The
> tech says that for him, whois shows the MSU contact info. He told me to go
> to http://who.is and see what it says. When he goes there, he sees the
> updated MSU contacts. When I go there, I see the old Penn State contacts.
> Strange. Then he says he'll get up and go to an external computer and see
> what comes up. He puts me on hold for a few minutes and comes back saying
> that from outside GD, he saw the old info, too. Good! So now at least GD
> understands that something really is wrong. But how can we both go to the
> same external site and get two different results?
http://who.is is powered by amazon EC2 (if you trust the WHOIS results
for 184.73.233.186 anyway...). This may mean it is possible for your
request to be serviced by a different machine in possibly a different
datacenter than the GoDaddy fellow. It is also possible that one or
both of you are using a caching proxy that cached old results. It is
also possible that even if you were served by EC2 in the same
datacenter; they could be doing a data refresh where the machine that
served you and the machine the served the GoDaddy fellow just had
different copies of data; typically this works itself out over
relatively short periods of time (minutes.)
> At this point he's going to escalate the issue, and goes back to the
> external computer to get a screenshot to staple to the screenshot from his
> workstation. But this time it shows the MSU info, not the Penn State info.
> So I emailed him a screenshot from my computer, where at least it's
> consistently wrong.
>
> So what the heck is going on? I am flummoxed. At least I got an incident
> number out of it. Previously I think GD just thought I was crazy.
>
> --
> Carl Raymond
> Software Developer
> University Outreach & Engagement
> Michigan State University
> Kellogg Center, Garden Level
> East Lansing, MI 48824-1022
>
> [log in to unmask]
> (517) 353-8977
> http://outreach.msu.edu/
>
|
