 |
 |
On Tue, Apr 20, 2010 at 4:17 PM, Carl Raymond <[log in to unmask]> wrote: > I've been having a strange problem with an external domain name registered > at GoDaddy, and it keeps getting stranger. About a month ago, we (my > department) took over management of the domain outreachscholarship.org from > Penn State. My boss logged into GoDaddy and updated the administrative, > technical, and billing contacts with his info. We built a fancy new web > site, and last Monday I logged into GD's DNS management system to update the > IP address to our web server here at MSU. I was still getting the old IP > address long after it should have propagated around. As was my boss, and > his boss. Not good. Several calls into GD show that for them, they see the > new IP address, but I see the old one. How long was 'should have propagated around?' What nameservers did you use? Did you query the authoritative nameserver for your domain? Did you use dig +trace or a similar tracing command to make sure that the correct authoritative nameservers for your domain are listed? Part of the problem with these sorts of problems is that many of them work themselves out in a number of hours (see results below; which look fairly normal) > > Here's the first weird thing: the tech suggested using a proxy, > www.megaproxy.com, to bring up the site. When they do that, they see the > new site. When I do that, I see the old site. How can we both go to the > same proxy and see something different? That would depend on how the proxy is configured. Does it use a CDN to determine where to route your request? All kinds of complications. But ignore the proxy (and ignore whois for the time being; it is not relevant.) PS: I have no idea how much you actually know about DNS, so pardon if I keep it quite high-level; not trying to insult anyone. First we need to determine what DNS in general thinks your authoritative nameservers are. If these are wrong it is likely the cause of all your problems. DNS is a tree hierarchy, so what we do is start at the top (the . domain) and ask it "hey where can I find outreachscholarship.org?" and it will tell us "I dunno, ask .org., here is their address" and then we go ask .org. "hey where can I find outreachscholarship.org" and they say "ns08.domaincontrol.com." Then we ask "ns08.domaincontrol.com." "hey what is the IP of "outreachscholarship.org" and they tell us "64.202.189.170". All that crap is basically covered by the command below. Note that @8.8.8.8 is Google DNS, which I am using because its a handy IP and I know it is not totally mis-configured. antarus@kyoto ~$ dig +trace @8.8.8.8 outreachscholarship.org ; <<>> DiG 9.4.3-P4 <<>> +trace @8.8.8.8 outreachscholarship.org ; (1 server found) ;; global options: printcmd . 35860 IN NS a.root-servers.net. . 35860 IN NS b.root-servers.net. . 35860 IN NS c.root-servers.net. . 35860 IN NS d.root-servers.net. . 35860 IN NS e.root-servers.net. . 35860 IN NS f.root-servers.net. . 35860 IN NS g.root-servers.net. . 35860 IN NS h.root-servers.net. . 35860 IN NS i.root-servers.net. . 35860 IN NS j.root-servers.net. . 35860 IN NS k.root-servers.net. . 35860 IN NS l.root-servers.net. . 35860 IN NS m.root-servers.net. ;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 58 ms ;; Us asking @8.8.8.8 for for the . server addresses. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS b2.org.afilias-nst.org. org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. ;; Received 443 bytes from 192.203.230.10#53(e.root-servers.net) in 40 ms ;; Us asking @e.root-servers.net for .org. server addresses outreachscholarship.org. 86400 IN NS ns07.domaincontrol.com. outreachscholarship.org. 86400 IN NS ns08.domaincontrol.com. ;; Received 96 bytes from 199.19.53.1#53(c0.org.afilias-nst.info) in 171 ms ;; Us asking @c0.org.afilias-nst.info for outreachscholarship.org. addresses outreachscholarship.org. 3600 IN A 64.202.189.170 outreachscholarship.org. 3600 IN NS ns07.domaincontrol.com. outreachscholarship.org. 3600 IN NS ns08.domaincontrol.com. ;; Received 112 bytes from 216.69.185.4#53(ns07.domaincontrol.com) in 66 ms ;; Us asking @ns07.domaincontrol.com. for the IP address for outreachscholarship.org. and getting a reply. We can double check whether ns07.domaincontrol.com thinks it is Authoritative for outreachscholarship.org by asking it a brief question. antarus@kyoto ~$ dig @ns07.domaincontrol.com. outreachscholarship.org a ; <<>> DiG 9.4.3-P4 <<>> @ns07.domaincontrol.com. outreachscholarship.org a ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18761 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;outreachscholarship.org. IN A ;; ANSWER SECTION: outreachscholarship.org. 3600 IN A 64.202.189.170 ;; AUTHORITY SECTION: outreachscholarship.org. 3600 IN NS ns07.domaincontrol.com. outreachscholarship.org. 3600 IN NS ns08.domaincontrol.com. They think they are authoritative for that domain (See the Authority:2 above). If they were serving replies for your domain that were not marked as Authoritative that would be bad; so we can eliminate that as a problem. The TTL for outreachscholariship.org is only 3600 seconds (one hour) so properly behaved caching DNS nameservers should probably have purged the old records by now (Servers can basically return existing records up to TTL seconds, so if you change the record it should take no longer than TTL seconds to propagate out in a world where all DNS servers were configured ideally (they are not FYI)). I can't say that all caching DNS servers are 'properly behaved' and many ignore the TTL and cache for some random time (24 hours is pretty common.) DNS is a distributed system which means that there is no 'master database' where we can just make a DNS change and expect it to show up everywhere; sometimes it just takes time. There may be third party services that attempt to track 'how far' a given DNS change has made it around the internet; however I've never used such a service (although intriguing in principle.) In short; these problems are hard to track after the fact precisely because we do not have heavy introspection into such a distributed service. > > After several calls to GD getting nowhere, we decided to transfer the > registration to Network Solutions, where we have several other domains > registered. So we go through the steps to transfer. My boss ends up > getting a message that says a request for transfer confirmation was sent to > the administrative contact, which it shows as the old contact at Penn State. > I did a whois lookup, and see the old Penn State contacts. Aha! The GD > contact info didn't propagate to the underlying registry back when he > updated it in March. So I call GD again to ask what to do about that. The > tech says that for him, whois shows the MSU contact info. He told me to go > to http://who.is and see what it says. When he goes there, he sees the > updated MSU contacts. When I go there, I see the old Penn State contacts. > Strange. Then he says he'll get up and go to an external computer and see > what comes up. He puts me on hold for a few minutes and comes back saying > that from outside GD, he saw the old info, too. Good! So now at least GD > understands that something really is wrong. But how can we both go to the > same external site and get two different results? http://who.is is powered by amazon EC2 (if you trust the WHOIS results for 184.73.233.186 anyway...). This may mean it is possible for your request to be serviced by a different machine in possibly a different datacenter than the GoDaddy fellow. It is also possible that one or both of you are using a caching proxy that cached old results. It is also possible that even if you were served by EC2 in the same datacenter; they could be doing a data refresh where the machine that served you and the machine the served the GoDaddy fellow just had different copies of data; typically this works itself out over relatively short periods of time (minutes.) > At this point he's going to escalate the issue, and goes back to the > external computer to get a screenshot to staple to the screenshot from his > workstation. But this time it shows the MSU info, not the Penn State info. > So I emailed him a screenshot from my computer, where at least it's > consistently wrong. > > So what the heck is going on? I am flummoxed. At least I got an incident > number out of it. Previously I think GD just thought I was crazy. > > -- > Carl Raymond > Software Developer > University Outreach & Engagement > Michigan State University > Kellogg Center, Garden Level > East Lansing, MI 48824-1022 > > [log in to unmask] > (517) 353-8977 > http://outreach.msu.edu/ >