> -----Original Message-----
> From: Alec Warner [mailto:[log in to unmask]]
> Sent: Wednesday, April 21, 2010 3:54 AM
> To: [log in to unmask]
> Subject: Re: [MSUNAG] DNS guru-level help needed
>
> On Tue, Apr 20, 2010 at 4:17 PM, Carl Raymond <[log in to unmask]> wrote:
> > I've been having a strange problem with an external domain name
> registered
> > at GoDaddy, and it keeps getting stranger. About a month ago, we (my
> > department) took over management of the domain
> outreachscholarship.org from
> > Penn State. My boss logged into GoDaddy and updated the
> administrative,
> > technical, and billing contacts with his info. We built a fancy new
> web
> > site, and last Monday I logged into GD's DNS management system to
> update the
> > IP address to our web server here at MSU. I was still getting the
> old IP
> > address long after it should have propagated around. As was my boss,
> and
> > his boss. Not good. Several calls into GD show that for them, they
> see the
> > new IP address, but I see the old one.
>
> How long was 'should have propagated around?' What nameservers did
> you use? Did you query the authoritative nameserver for your domain?
> Did you use dig +trace or a similar tracing command to make sure that
> the correct authoritative nameservers for your domain are listed?
> Part of the problem with these sorts of problems is that many of them
> work themselves out in a number of hours (see results below; which
> look fairly normal
>
> >
> > Here's the first weird thing: the tech suggested using a proxy,
> > www.megaproxy.com, to bring up the site. When they do that, they see
> the
> > new site. When I do that, I see the old site. How can we both go to
> the
> > same proxy and see something different?
>
> That would depend on how the proxy is configured. Does it use a CDN
> to determine where to route your request? All kinds of complications.
> But ignore the proxy (and ignore whois for the time being; it is not
> relevant.)
> PS: I have no idea how much you actually know about DNS, so pardon if
> I keep it quite high-level; not trying to insult anyone.
>
> First we need to determine what DNS in general thinks your
> authoritative nameservers are. If these are wrong it is likely the
> cause of all your problems. DNS is a tree hierarchy, so what we do is
> start at the top (the . domain) and ask it "hey where can I find
> outreachscholarship.org?" and it will tell us "I dunno, ask .org.,
> here is their address" and then we go ask .org. "hey where can I find
> outreachscholarship.org" and they say "ns08.domaincontrol.com." Then
> we ask "ns08.domaincontrol.com." "hey what is the IP of
> "outreachscholarship.org" and they tell us "64.202.189.170".
>
> All that crap is basically covered by the command below. Note that
> @8.8.8.8 is Google DNS, which I am using because its a handy IP and I
> know it is not totally mis-configured.
>
> antarus@kyoto ~$ dig +trace @8.8.8.8 outreachscholarship.org
>
> ; <<>> DiG 9.4.3-P4 <<>> +trace @8.8.8.8 outreachscholarship.org
> ; (1 server found)
> ;; global options: printcmd
> . 35860 IN NS a.root-servers.net.
> . 35860 IN NS b.root-servers.net.
> . 35860 IN NS c.root-servers.net.
> . 35860 IN NS d.root-servers.net.
> . 35860 IN NS e.root-servers.net.
> . 35860 IN NS f.root-servers.net.
> . 35860 IN NS g.root-servers.net.
> . 35860 IN NS h.root-servers.net.
> . 35860 IN NS i.root-servers.net.
> . 35860 IN NS j.root-servers.net.
> . 35860 IN NS k.root-servers.net.
> . 35860 IN NS l.root-servers.net.
> . 35860 IN NS m.root-servers.net.
> ;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 58 ms
> ;; Us asking @8.8.8.8 for for the . server addresses.
>
> org. 172800 IN NS a2.org.afilias-
> nst.info.
> org. 172800 IN NS b2.org.afilias-nst.org.
> org. 172800 IN NS a0.org.afilias-
> nst.info.
> org. 172800 IN NS b0.org.afilias-nst.org.
> org. 172800 IN NS c0.org.afilias-
> nst.info.
> org. 172800 IN NS d0.org.afilias-nst.org.
> ;; Received 443 bytes from 192.203.230.10#53(e.root-servers.net) in 40
> ms
> ;; Us asking @e.root-servers.net for .org. server addresses
>
> outreachscholarship.org. 86400 IN NS ns07.domaincontrol.com.
> outreachscholarship.org. 86400 IN NS ns08.domaincontrol.com.
> ;; Received 96 bytes from 199.19.53.1#53(c0.org.afilias-nst.info) in
> 171 ms
> ;; Us asking @c0.org.afilias-nst.info for outreachscholarship.org.
> addresses
>
> outreachscholarship.org. 3600 IN A 64.202.189.170
> outreachscholarship.org. 3600 IN NS ns07.domaincontrol.com.
> outreachscholarship.org. 3600 IN NS ns08.domaincontrol.com.
> ;; Received 112 bytes from 216.69.185.4#53(ns07.domaincontrol.com) in
> 66 ms
> ;; Us asking @ns07.domaincontrol.com. for the IP address for
> outreachscholarship.org. and getting a reply.
>
> We can double check whether ns07.domaincontrol.com thinks it is
> Authoritative for outreachscholarship.org by asking it a brief
> question.
>
> antarus@kyoto ~$ dig @ns07.domaincontrol.com. outreachscholarship.org a
>
> ; <<>> DiG 9.4.3-P4 <<>> @ns07.domaincontrol.com.
> outreachscholarship.org a
> ; (1 server found)
> ;; global options: printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18761
> ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
> ;; WARNING: recursion requested but not available
>
> ;; QUESTION SECTION:
> ;outreachscholarship.org. IN A
>
> ;; ANSWER SECTION:
> outreachscholarship.org. 3600 IN A 64.202.189.170
>
> ;; AUTHORITY SECTION:
> outreachscholarship.org. 3600 IN NS ns07.domaincontrol.com.
> outreachscholarship.org. 3600 IN NS ns08.domaincontrol.com.
>
> They think they are authoritative for that domain (See the Authority:2
> above). If they were serving replies for your domain that were not
> marked as Authoritative that would be bad; so we can eliminate that as
> a problem.
>
> The TTL for outreachscholariship.org is only 3600 seconds (one hour)
> so properly behaved caching DNS nameservers should probably have
> purged the old records by now (Servers can basically return existing
> records up to TTL seconds, so if you change the record it should take
> no longer than TTL seconds to propagate out in a world where all DNS
> servers were configured ideally (they are not FYI)). I can't say that
> all caching DNS servers are 'properly behaved' and many ignore the TTL
> and cache for some random time (24 hours is pretty common.) DNS is a
> distributed system which means that there is no 'master database'
> where we can just make a DNS change and expect it to show up
> everywhere; sometimes it just takes time. There may be third party
> services that attempt to track 'how far' a given DNS change has made
> it around the internet; however I've never used such a service
> (although intriguing in principle.)
>
> In short; these problems are hard to track after the fact precisely
> because we do not have heavy introspection into such a distributed
> service.
>
Thanks for the reply, Alec. This all started last week on Monday -- plenty of time for changes to propagate, and from what I can see, not one change has. I was doing similar diggery myself, getting the same results. On the GoDaddy DNS configuration site, it shows different authoritative name servers (ns33 and ns34 vs. ns07 and ns08). When I would dig with ns07, I would get the old IP address; with ns33, which is supposed to be authoritative, I would get NXDOMAIN. I tried adding a new A record as a diagnostic. That should sidestep any caching of old info, because there isn't any old info. But a query on the new name would return NXDOMAIN days later. What was most frustrating is that the GD people weren't very concerned about the authoritative name server discrepancy, and in fact hadn't heard of dig at all. Their answer to everything was that it just needs time to propagate.
Carl
|
