public-dns-discuss Google Group

Re: [public-dns-discuss] Domain not resolved by Google public DNS

jekovec.mat...@gmail.com (Matija Jekovec) — Sat, 18 May 2013 14:19:25 UT

Thank you, that resolved the situation.
Best Regards,

Re: [public-dns-discuss] Domain not resolved by Google public DNS

g...@google.com (Yunhong Gu) — Sat, 18 May 2013 03:55:48 UT

Some of resolvers cannot reach your nameservers. Please check if there is
any firewall blocking our IPs:
[link]

Domain not resolved by Google public DNS

jekovec.mat...@gmail.com (Matija Jekovec) — Fri, 17 May 2013 18:23:54 UT

Domain domenca.com and a range of domains in our vlan is being resolved by
every other DNS except Google public DNS. Could you please help us force
update of Google DNS service?

Re: [public-dns-discuss] kennicottguides.com NS reported incorrectly by 8.8.8.8

g...@google.com (Yunhong Gu) — Fri, 17 May 2013 18:17:45 UT

Ask the new DNS service provider to fix the NS records on
the authoritative nameserver. This has nothing to do with Google Public DNS
- other DNS resolvers will give the same result:

dig @4.2.2.1 kennicottguides.com ns

; <<>> DiG 9.8.1-P1 <<>> @4.2.2.1 kennicottguides.com ns
; (1 server found)

kennicottguides.com NS reported incorrectly by 8.8.8.8

patr...@vedanamedia.com — Fri, 17 May 2013 18:13:05 UT

After a recent domain transfer, my client's domain kennicottguides.com
should be hosted by *ns1.rhostbh.com *and* **ns2.rhostbh.com*, but are
instead still showing *ns1.abac.com* and *ns2.abac.com*. A look on *
[link] shows the problem, but I'm not
skilled enough to know what to do.

Re: [public-dns-discuss] Google's OWN domains not resolved by Google DNS

angelo.giuffr...@gmail.com (Angelo Giuffrida) — Fri, 17 May 2013 14:27:00 UT

I have no problems resolving google.com or gmail.com on 8.8.8.8 or 8.8.4.4
(in Melbourne, Australia):

Angelos-MacBook-Air:~ Angelo$ dig @8.8.8.8 google.com

; <<>> DiG 9.7.6-P1 <<>> @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36095

Re: [public-dns-discuss] Google's OWN domains not resolved by Google DNS

g...@google.com (Yunhong Gu) — Fri, 17 May 2013 14:24:39 UT

Can you post result of "dig @8.8.8.8 google.com" and "traceroute 8.8.8.8"?
And maybe try from a different browser/computer? We do not see any outage
on resolving google.com.

Thanks
Yunhong

Google's OWN domains not resolved by Google DNS

aaron.gibral...@gmail.com — Fri, 17 May 2013 14:17:12 UT

Anyone else sometimes find that the ONLY domains that don't resolve using
8.8.8.8/8.8.4.4 are google.com domains? I find almost every other domain
works, and I'm forced to search with Bing or change my network settings to
default DNS. #epicDNSfail

Re: [public-dns-discuss] Re: Google DNS is returning a SERVFAIL for PTR

g...@google.com (Yunhong Gu) — Thu, 16 May 2013 04:16:15 UT

We cannot reach any of your nameservers. Can you check if there is any
firewall that blocks our IP address, listed here:
[link]

Re: Google DNS is returning a SERVFAIL for PTR

jcpi...@gmail.com (Chris Piety) — Tue, 14 May 2013 14:53:39 UT

According to googles own troubleshooting recomendations here is the output
from another open resolver.

C:\Users\cpiety>nslookup -debug 161.45.157.30 4.2.2.2
------------
Got answer:
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: response, want recursion, recursion avail.

Re: [public-dns-discuss] Not resolving CNAME if zone is signed with DNSSEC?

g...@google.com (Yunhong Gu) — Mon, 13 May 2013 20:22:09 UT

Yes.

We turned on validation by default recently.

Re: [public-dns-discuss] Not resolving CNAME if zone is signed with DNSSEC?

jens.petters...@gmail.com — Mon, 13 May 2013 19:51:30 UT

So it's because of bad DNSSEC implementation and the fact that Google DNS
is actually DNSSEC aware, and almost everyone else isn't? Just strange
since it worked up until a week ago, or so...

Re: [public-dns-discuss] Not resolving CNAME if zone is signed with DNSSEC?

g...@google.com (Yunhong Gu) — Mon, 13 May 2013 19:35:16 UT

Because your name server does not return signature for the A record
returned together with the CName record.

; <<>> DiG 9.8.1-P1 <<>> [link] +dnssec +norec @
ns1.interactivehealthgroup.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2038

Not resolving CNAME if zone is signed with DNSSEC?

jens.petters...@gmail.com — Mon, 13 May 2013 19:20:41 UT

Same *authoritative* DNS-server; CNAME www in DNSSEC signed zone viedoc.com
does not resolve ([link]), whereas CNAME www in non-signed zone
viedoc.eu resolves ([link]).
Any ideas?

Re: [public-dns-discuss] Google DNS is returning a SERVFAIL for PTR

zaph...@zaphods.net (Stefan Schmidt) — Mon, 13 May 2013 15:20:36 UT

This is just the usual thing that happens when none of the authoritative
nameservers for a domain are responding.

➜ ~ dig -x 161.45.157.30 +trace
...
45.161.in-addr.arpa. 86400 IN NS dns-dmz1.mtsu.edu.
45.161.in-addr.arpa. 86400 IN NS dns-dmz2.mtsu.edu.
45.161.in-addr.arpa. 86400 IN NS dns-res1.mtsu.edu.

Google DNS is returning a SERVFAIL for PTR

jcpi...@gmail.com (Chris Piety) — Mon, 13 May 2013 12:52:32 UT

Forward lookup works but not reverse DNS.

DNS-DMZ1:/# dig @8.8.8.8 -x [link]
; <<>> DiG 9.8.3-P4 <<>> @8.8.8.8 -x [link]
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 15273
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

Re: [public-dns-discuss] Re: add nameserver to whitelist for edns-client-subnet

minjaehw...@google.com (MinJae Hwang) — Mon, 13 May 2013 07:54:48 UT

Hi,
As I wrote in the previous message, your nameservers were added to the
whitelist. For future request, please write a message on the issue tracker.
Thanks.

Re: [public-dns-discuss] Digest for public-dn...@googlegroups.com - 10 Messages in 5 Topics

minjaehw...@google.com (MinJae Hwang) — Mon, 13 May 2013 07:53:47 UT

Hi,
Sorry it took long time. Your nameservers were added to the whitelist. For
future request, please write a message on the issue tracker.
Thanks,

Re: debian.org problems with BIND and DNSSEC

minjaehw...@google.com (MinJae Hwang) — Mon, 13 May 2013 07:51:49 UT

Yunhong replied that [link] was failing the validation on May, 9th.

Re: debian.org problems with BIND and DNSSEC

minjaehw...@google.com (MinJae Hwang) — Mon, 13 May 2013 07:51:12 UT

Hi Aaron,
Could you try the following?
dig @8.8.8.8 +dnssec [link]
It seems to me that '[link] works just fine and Google Public DNS
returns an authenticated response.

Re: [public-dns-discuss] Digest for public-dns-discuss@googlegroups.com - 10 Messages in 5 Topics

zhuifengs...@gmail.com (福华曾) — Mon, 13 May 2013 02:01:23 UT

Hi, Yunhong

please add these nameservers（ns1-ns7.hacdn.net） :
61.49.23.84
113.5.253.183
61.156.157.156
61.142.66.59
119.97.137.156
125.64.94.86
202.109.72.120

to Whitelist for EDNS-client-subnet.

you can test via domain 'c01.i01.hacdn.net.'

thanks very much!

2013/4/30 <public-dns-discuss@googlegrou ps.com>

Re: [public-dns-discuss] SERVFAIL

g...@google.com (Yunhong Gu) — Mon, 13 May 2013 02:51:20 UT

dominiodns.com is working fine now. Your DNS change may not be updated on
resolvers until the old TTL expires (this include both the old record from
the authoritative name servers and/or the delegation record from parent
name servers).

; <<>> DiG 9.7.0-P1 <<>> @8.8.8.8 dominiodns.com
; (1 server found)

Re: [public-dns-discuss] Re: add nameserver to whitelist for edns-client-subnet

g...@google.com (Yunhong Gu) — Mon, 13 May 2013 02:04:15 UT

We will address this in the issue tracker you created.

Thanks
Yunhong

Re: [public-dns-discuss] BIND server unable to resolve debian.org with DNSSEC enabled

g...@google.com (Yunhong Gu) — Mon, 13 May 2013 01:59:50 UT

debian.org was failing DNSSEC validation on May 9. The problem has been
fixed on the same day.

On Thu, May 9, 2013 at 9:25 PM, Aaron Riekenberg <aaron.riekenb...@gmail.com

add nameserver to whitelist for edns-client-subnet

zhuifengs...@gmail.com (福华曾) — Fri, 10 May 2013 06:33:23 UT

Hi,

please add these nameservers:
61.49.23.84
113.5.253.183
61.156.157.156
61.142.66.59
119.97.137.156
125.64.94.86
202.109.72.120

to Whitelist for EDNS-client-subnet.

you can test via domain 'c01.i01.hadns.net.'

thanks.

Re: add nameserver to whitelist for edns-client-subnet

zhuifengs...@gmail.com (福华曾) — Fri, 10 May 2013 10:17:16 UT

Hi,

i'am so sorry, the test domain is 'c01.i01.hacdn.net.', not 'c01.i01.hadns.net'

please add these nameservers:
61.49.23.84
113.5.253.183
61.156.157.156
61.142.66.59
119.97.137.156
125.64.94.86
202.109.72.120

to Whitelist for EDNS-client-subnet.

you can test via domain 'c01.i01.hacdn.net <[link]>.'

SERVFAIL

deniscoll...@gmail.com — Sun, 12 May 2013 11:55:37 UT

Hello,
About 5 hours ago we have updated the IPs of our DNS servers but google's
public DNS servers are having problems resolving our domain name now (this
is our main dns, our users use this dns for their domains).
When we run dig we get the following:
dig @8.8.8.8 dominiodns.com.
; <<>> DiG 9.6-ESV-R4-P3 <<>> @8.8.8.8 dominiodns.com.

BIND server unable to resolve debian.org with DNSSEC enabled

aaron.riekenb...@gmail.com (Aaron Riekenberg) — Fri, 10 May 2013 01:25:24 UT

I have a BIND 9 server forwarding to 8.8.8.8 and 8.8.4.4.
Today I'm finding my server can't resolve debian.org when DNSSEC is
enabled, but it works with DNSSEC disabled. All other domains I've tried
work with DNSSEC enabled.
debian.org worked with DNSSEC enabled with this same configuration
yesterday.

debian.org problems with BIND and DNSSEC

aaron.riekenb...@gmail.com — Fri, 10 May 2013 01:17:32 UT

I have a BIND 9 server set up to use DNSSEC and foward queries to 8.8.8.8
and 8.8.4.4.
Tonight I'm finding my server can't resolve debian.org if DNSSEC is
enabled, but it works with DNSSEC disabled. All other sites I've tried
with DNSSEC enabled work fine. debian.org was working with DNSSEC and this

Re: intermittantly cannot resolve ausdool.com

roger.chapp...@mediatwo.com.au (roger chappell) — Tue, 07 May 2013 03:41:58 UT

Hi,
I don't know, I stopped using the Google DNS on my modem because of it. I
shall set it back again, and update this either way over the next few days.
Thanks,
Roger

Re: intermittantly cannot resolve ausdool.com

shen...@google.com (Shen Wan) — Mon, 06 May 2013 14:11:35 UT

Hi Roger,
Sorry for missing your post. Does this issue still exist?
On May 2, the nameserver 122.201.78.139 sometimes replied NODATA to us for
ausdool.com.

Re: [public-dns-discuss] Google Public DNS is returning a SERVFAIL for my domain

marco.dav...@sidn.nl (Marco Davids) — Sun, 05 May 2013 13:16:36 UT

This handy page visualises it:
[link]
Google turned on DNSSEC-validation only recently.

Re: [public-dns-discuss] significant time out

g...@google.com (Yunhong Gu) — Sat, 04 May 2013 20:22:33 UT

It means that 8.8.8.8 may be blocked in your area. Please consult your ISP
support.

Re: [public-dns-discuss] Google Public DNS is returning a SERVFAIL for my domain

g...@google.com (Yunhong Gu) — Sat, 04 May 2013 20:20:49 UT

The name is failing DNSSEC validation. It has a DS record in the parent
zone, but there is no DNSKEY or RRSIG in the zone. Either remove the DS
record or add DNSKEY and sign everything in the zone.

Google Public DNS is returning a SERVFAIL for my domain

support-t...@prohosterz.com (prohosterz) — Sat, 04 May 2013 19:33:15 UT

Hello Everyone,
Hope some one will help me in resolving the issue. My Domain name is
"prohosterz.com"
Google Public DNS is returning a SERVFAIL for my domain:
$ dig prohosterz.com @8.8.8.8
; <<>> DiG 9.9.2 <<>> prohosterz.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1806

significant time out

angshyc...@gmail.com (Ang) — Sat, 04 May 2013 08:24:58 UT

how to solve this timeout problems? i had follow all instruction from
public DNS.
Tracing route to 8.8.8.8 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 192.168.0.1
2 3 ms 3 ms 5 ms 175.137.111.94
3 * * * Request timed out.
4 * * * Request timed out.

Re: Can't resolve some subdomains of wildcard record

minjaehw...@google.com (MinJae Hwang) — Fri, 03 May 2013 19:02:44 UT

The logs showed that your authoritative nameserver had been refused queries
from Google Public DNS for sometime. The reason is not clear at this point.
For now, I believe it is working fine all over the world.

intermittantly cannot resolve ausdool.com

roger.chapp...@mediatwo.com.au (roger chappell) — Fri, 03 May 2013 00:47:48 UT

Hi,
intermittantly, when I do a DNS lookup for the domain ausdool.com against
Google (8.8.8.8) nothing is returned for an A record.
So, It appears that Google has not correctly cached the DNS settings for
the ausdool.com domain. How can I get this fixed, as most bigpond.com ISP
users in Australia cannot access this website half the time.

Re: Can't resolve www.pay.gov

minjaehw...@google.com (MinJae Hwang) — Thu, 02 May 2013 23:00:40 UT

It is a DNSSEC validation failure. One of the authoritative nameserver
(IPv6 = 2605:3100:fffd:100::7) returns NODATA for the DNSKEY of pay.gov. If
you are the owner of the domain, please fix it.

Re: Can't resolve www.pay.gov

minjaehw...@google.com (MinJae Hwang) — Thu, 02 May 2013 22:56:32 UT

I'm sorry for the trouble you are experiencing. We are investigating the
issue now. We will let you know if we find anything.

Re: Ewals.nl does not resolve ewals.com does

minjaehw...@google.com (MinJae Hwang) — Thu, 02 May 2013 22:32:25 UT

Hi,
ewals.nl is failing DNSSEC validation.
[link]
Please fix it.

Can't resolve some subdomains of wildcard record

iamc...@gmail.com — Thu, 02 May 2013 16:33:23 UT

The record for *.slack.com is a wildcard CNAME, but Google DNS can only
resolve some subdomains, failing on others.
There does not appear to be any DNSSEC enabled:
* [link]
* [link]
* [link]
* [link]

Can't resolve www.pay.gov

peppe...@gmail.com — Thu, 02 May 2013 15:16:24 UT

Resolves fine from 4.2.2.1, 4.2.2.2, 208.67.222.222, and 208.67.220.220

Ewals.nl does not resolve ewals.com does

cox.k...@gmail.com (Kris Cox) — Thu, 02 May 2013 13:40:40 UT

Hi,

Ewals.nl and [link] is not resolvable via google public dns entries.

C:\Users\Krisc>nslookup -debug [link]. 8.8.8.8
------------
Got answer:
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0, additional = 0

Re: Can't resolve my domain 'othree.net'

oth...@gmail.com — Thu, 02 May 2013 03:15:35 UT

Problem Solved, Thanks for help.
Someone set a DS record for my domain on upstream.
And the hash is '12345678901234567890123456789 01234657890' ....
So I ask them to delete it.
Back to normal this morning.

Re: Can't resolve ooki-cdn.com

shen...@google.com (Shen Wan) — Tue, 30 Apr 2013 20:14:17 UT

ooki-cdn.com fails DNSSEC validation. See
[link] for an explanation.

Re: Can't resolve my domain 'othree.net'

oth...@gmail.com — Tue, 30 Apr 2013 16:41:48 UT

Just understand the reason.
Parent server have a DS record.
But there is no DNSKEY match it.
Thanks.
I am reporting this issue back to my DNS.

Can't resolve ooki-cdn.com

remi.tho...@gmail.com — Tue, 30 Apr 2013 16:32:29 UT

dev0:~# nslookup
Default server: 8.8.8.8
Address: 8.8.8.8#53
Server: 8.8.8.8
Address: 8.8.8.8#53
** server can't find ooki-cdn.com: SERVFAIL

Re: [public-dns-discuss] Re: Problems resolving all domains hosted at Amazon Route 53

davidbl1...@gmail.com (David Bjørnsten-Lindhard) — Tue, 30 Apr 2013 15:06:22 UT

Iv'e actually done some more digging now. And it all makes sense now.
thanks for the site you linked to by the way!
Seems that it was all the tld (.dk) domains located at our account 100+
that had this problem.
It ended up beeing that our tld nic had generated keys for them as we had
enabled dnssec at nic level.

Re: [public-dns-discuss] Re: Problems resolving all domains hosted at Amazon Route 53

g...@google.com (Yunhong Gu) — Tue, 30 Apr 2013 15:01:12 UT

This is just a specific case, NOT all domains on Route 53. We do not
validate domains that are not signed by DNSSEC. Google Public DNS is not
the only DNSSEC validating resolver, others such comcast DNS also validate.

On Tue, Apr 30, 2013 at 10:48 AM, David Bjørnsten-Lindhard <