Re: [public-dns-discuss] Digest for public-dns-discuss@googlegroups.com - 10 Messages in 5 Topics

31 views

Skip to first unread message

福华曾

unread,

May 12, 2013, 10:01:23 PM5/12/13

to public-dn...@googlegroups.com

Hi, Yunhong

please add these nameservers（ns1-ns7.hacdn.net）:
61.49.23.84
113.5.253.183
61.156.157.156
61.142.66.59
119.97.137.156
125.64.94.86
202.109.72.120

to Whitelist for EDNS-client-subnet.

you can test via domain 'c01.i01.hacdn.net.'

thanks very much!

2013/4/30 <public-dn...@googlegroups.com>

Today's Topic Summary

Group: http://groups.google.com/group/public-dns-discuss/topics

Google public DNS is responding with a SERVFAIL because DNSSEC won't validate [2 Updates]

DNS Slow to update for domain [2 Updates]

Domain not resolving [2 Updates]

Google public-dns can't resolve my domain [2 Updates]

Whitelist IP to support EDNS-client subnet [2 Updates]

Google public DNS is responding with a SERVFAIL because DNSSEC won't validate

Jefferson Deshaun <jefferso...@gmail.com> Apr 29 09:14AM -0700

I'm currently having a problem with my registrar where they can't remove
the DS records that were pushed upstream to .org

I'd rather get Google to stop validating for this domain until I get this
fixed.

Can I get in contact with someone in private and I can validate ownership
of the domain?

Right now anyone who is using a DNSsec validating resolver cannot reach my
website.

Thanks

Yunhong Gu <g...@google.com> Apr 29 09:50PM -0400

Can you re-sign the rrsets if you still have the DNSKEY corresponding to
the DS? In general we cannot process such request because this is a manual
operation and the domain owner can usually fix the problem.

On Mon, Apr 29, 2013 at 12:14 PM, Jefferson Deshaun <

DNS Slow to update for domain

Matthew Scully <mattz...@googlemail.com> Apr 29 12:33PM -0700

Hey There Guys,

Any ideas why minifigs.me hasn't updated yet on Google DNS?

C:\Users\Matt>nslookup minifigs.me 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8

Non-authoritative answer:
Name: minifigs.me
Address: 63.141.244.218

C:\Users\Matt>nslookup minifigs.me 208.67.222.222
Server: resolver1.opendns.com
Address: 208.67.222.222

Non-authoritative answer:
Name: minifigs.me
Address: 198.245.63.153

Should be the one got from OpenDNS

The DNS was updated at least 30+ minutes ago and the domain has a TTL of
300.

Any information would be helpful,

Regards,

Matt

Yunhong Gu <g...@google.com> Apr 29 09:40PM -0400

It is the TTL of the old record, NOT that new one, that decides how long
the old record will stay in cache. In addition, if you changes name server,
the delegation record from the parent zone can also send the query to the
old name server before its own TTL expires.

Anyway, we have an upper threshold of 6 hours for caching, so your change
should have been effective on 8.8.8.8 by now.

On Mon, Apr 29, 2013 at 3:33 PM, Matthew Scully

Domain not resolving

ernes...@gmail.com Apr 29 04:45PM -0700

*Domain www.bncr.fi.cr is not resolving from 8.8.8.8 but working from other
open DNS servers including 4.2.2.2*

C:\Users\egonzalez>nslookup -debug www.bncr.fi.cr 4.2.2.2
------------
Got answer:
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0, additional = 0

QUESTIONS:
2.2.2.4.in-addr.arpa, type = PTR, class = IN
ANSWERS:
-> 2.2.2.4.in-addr.arpa
name = b.resolvers.Level3.net
ttl = 61899 (17 hours 11 mins 39 secs)

------------
Server: b.resolvers.Level3.net
Address: 4.2.2.2

------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0, additional = 0

QUESTIONS:
www.bncr.fi.cr, type = A, class = IN
ANSWERS:
-> www.bncr.fi.cr
internet address = 200.122.146.45
ttl = 2973 (49 mins 33 secs)

------------
Non-authoritative answer:
------------
Got answer:
HEADER:
opcode = QUERY, id = 3, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
www.bncr.fi.cr, type = AAAA, class = IN
AUTHORITY RECORDS:
-> bncr.fi.cr
ttl = 3527 (58 mins 47 secs)
primary name server = ns.bncr.fi.cr
responsible mail addr = hostmaster.bncr.fi.cr
serial = 110
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)

------------
Name: www.bncr.fi.cr
Address: 200.122.146.45

C:\Users\egonzalez>
C:\Users\egonzalez>
C:\Users\egonzalez>
C:\Users\egonzalez>
C:\Users\egonzalez>nslookup -debug www.bncr.fi.cr 8.8.8.8
------------
Got answer:
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0, additional = 0

QUESTIONS:
8.8.8.8.in-addr.arpa, type = PTR, class = IN
ANSWERS:
-> 8.8.8.8.in-addr.arpa
name = google-public-dns-a.google.com
ttl = 20463 (5 hours 41 mins 3 secs)

------------
Server: google-public-dns-a.google.com
Address: 8.8.8.8

------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = SERVFAIL
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.bncr.fi.cr, type = A, class = IN

------------
------------
Got answer:
HEADER:
opcode = QUERY, id = 3, rcode = SERVFAIL
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.bncr.fi.cr, type = AAAA, class = IN

------------
------------
Got answer:
HEADER:
opcode = QUERY, id = 4, rcode = SERVFAIL
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.bncr.fi.cr, type = A, class = IN

------------
------------
Got answer:
HEADER:
opcode = QUERY, id = 5, rcode = SERVFAIL
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
www.bncr.fi.cr, type = AAAA, class = IN

------------
*** google-public-dns-a.google.com can't find www.bncr.fi.cr: Server failed

Could you guys please assist on pointing out what might me the issue?

Thanks in advance for your time and help!

Yunhong Gu <g...@google.com> Apr 29 09:31PM -0400

It is failing DNSSEC validation: http://dnsviz.net/d/www.bncr.fi.cr/dnssec/

Google public-dns can't resolve my domain

trgyt...@gmail.com Apr 29 04:13AM -0700

All the others DNS resolve my domain, but google don't. I try OpenDNS
and some others and they are ok.

meram.bel.tr

Yunhong Gu <g...@google.com> Apr 29 11:52AM -0400

It is because your name servers do not respond either NS or their A
records. See also http://www.intodns.com/meram.bel.tr.

; <<>> DiG 9.8.1-P1 <<>> meram.bel.tr @ns5.nic.tr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8603
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;meram.bel.tr. IN A

;; AUTHORITY SECTION:
meram.bel.tr. 43200 IN NS ns1.meramdaiftar.com.
meram.bel.tr. 43200 IN NS ns1.merambel.com.

============================

; <<>> DiG 9.8.1-P1 <<>> ns1.meramdaiftar.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 15385
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns1.meramdaiftar.com. IN A

;; AUTHORITY SECTION:
meramdaiftar.com. 60 IN SOA gis.merambld.local. hostmaster.merambld.local.
30 900 600 86400 3600

======================

; <<>> DiG 9.8.1-P1 <<>> ns1.merambel.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 58732
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;ns1.merambel.com. IN A

=======================

; <<>> DiG 9.8.1-P1 <<>> meram.bel.tr ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22426
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;meram.bel.tr. IN NS

;; ANSWER SECTION:
meram.bel.tr. 3375 IN NS gis.merambld.local.

Whitelist IP to support EDNS-client subnet

thanhn...@gmail.com Apr 28 09:49PM -0700

Hi Yunhong Gu ,

Thank you for your reply. However I'm a little bit confusing about that
when I use cmd "dig vcdn.vn ns" I can see *ns3.vcdn.vn*.
Moreover, Open DNS can still send edns-client-subnet packages to
ns3.vcdn.vn but Google DNS is not?

Here is our cmd detail:
[root@haproxy nhadt]# dig vcdn.vn ns

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> vcdn.vn ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48250
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;vcdn.vn. IN NS

;; ANSWER SECTION:
vcdn.vn. 259 IN NS ns3.vcdn.vn.
vcdn.vn. 259 IN NS ns1.vcdn.vn.
vcdn.vn. 259 IN NS ns2.vcdn.vn.

;; Query time: 42 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Apr 29 11:00:18 2013
;; MSG SIZE rcvd: 79

What should I do next to resolve this problem?

Thanks & Regards,
Nha Dang

On Sunday, April 28, 2013 11:47:13 AM UTC+7, Yunhong Gu wrote:

Yunhong Gu <g...@google.com> Apr 29 11:28AM -0400

Those are two different NS rrset. That one in your email was from
authoritative nameservers; the other one in my email was from the parent
zone for delegation. The delegation is the one we use to resolve a name.
This is a configuration error that you have to fix. See also
http://www.intodns.com/vcdn.vn.

Yunhong

You received this message because you are subscribed to the Google Group public-dns-discuss.
You can post via email.
To unsubscribe from this group, send an empty message.
For more options, visit this group.

--
--
========================================================
You received this message because you are subscribed to the Google
Groups "public-dns-discuss" group.
To post to this group, send email to public-dn...@googlegroups.com
To unsubscribe from this group, send email to
public-dns-disc...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/public-dns-discuss?hl=en
For more information on Google Public DNS, please visit
http://code.google.com/speed/public-dns
========================================================

---
You received this message because you are subscribed to the Google Groups "public-dns-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to public-dns-disc...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

MinJae Hwang

unread,

May 13, 2013, 3:53:47 AM5/13/13

to public-dn...@googlegroups.com

Hi,

Sorry it took long time. Your nameservers were added to the whitelist. For future request, please write a message on the issue tracker.