Sign in

NXDOMAIN on the office network, yet the registrar swears our shop's new .com is fine ugh

Solveddnsdomainsnxdomain10 replies · 289 views · started
Reply
Accepted solution by Quinn Haddad — lol same thing happened to me negative answers are cached too. if resolvers saw NXDOMAIN, they keep that for the SOA minimum or negative…
  1. Diego Moreau
    @dmoreau_20

    yesterday i finsihed turning on DNSSEC for our shops new .com. felt proud of myself. this mroning i opened the site and got this:

    This site can't be reached

    This site can't be reached
Check if there is a typo in my-shop-site.example.
If spelling is correct, try running Windows Network Diagnostics.
DNS_PROBE_FINISHED_NXDOMAIN

    it says teh servers IP address could not be found, DNS_PROBE_FINISHED_NXDOMAIN. same thing on the office network. the registrar dashboard shows the domain as active and the records look right to me. ive read everything about propagation but this feels different. how do I tell if its just waiting or if I actually broke smth?

    1
  2. Uma Becker
    @ubecker-3qb

    Did you check teh WHOIS status for anything like clientHold?

    14 1 helpful
  3. Diego Moreau
    @dmoreau_20
    in reply to @ubecker-3qb

    WHOIS shows clientHold, i never got an email.... 😤 or maybe it went to an old address after turning on DNSSEC. hope thats enough info 😅

    2 8 helpful
  4. Wes
    @wes_byte
    in reply to @dmoreau_20

    yeahhh start from the top of the chain: dig +trace example.com follows the delegation from the root servers down 😂 if it stops at the TLD servers with no NS records, the registrar doesnt have ur nameservers set, if it reaches your nameservers but they return NXDOMAIN, the zone itself is missnig or the record isnt there.

    thumbsup

    2 1 helpful
  6. Kira Ferreira
    @kira.ferreira

    if DNSSEC is involved: after changing nameservers, the old DS record at the registrar no longer matches teh new zones keys. validating resolvers then refuse to answer, and many users see the site as gone... remove the DS record at the registrar, or publish the new DS from your new DNS provider. fingers crossed 🤞

    thinking

    0 3 helpful
  7. Una Silva
    @una_shader-35k

    yeahhh when you move DNS providers, the new zone starts empty unless you import it. Run dig A example.com @new-ns-server directly against teh new nameserver. if that returns nothing, recreate the records there before blaming propagation.

    1 2 helpful
  8. Quinn Haddad
    @packetworks-38x
    Accepted solution

    lol same thing happened to me negative answers are cached too. if resolvers saw NXDOMAIN, they keep that for the SOA minimum or negative TTL, often up to an hour or more. clear your local cache with ipconfig /flushdns on Windows and chrome://net-internals/#dns in Chrome, and test with a public resolver like nslookup example.com 1.1.1.1.

    this vid explains it way better than me lol

    ▶ How to Fix DNS_PROBE_FINISHED_NXDOMAIN in Chrome

    0 10 helpful
  10. Wes
    @wes_byte
    in reply to @otton541

    id avoid DNSSEC entirely for small sites during migrations, turn it off, migrate, then re-enable once everything is stable. less to go wrong.

    11 3 helpful
  11. Diego Moreau
    @dmoreau_20
    in reply to @packetworks-38x

    @packetworks-38x WOWWW found the verification email in an old inbox, clicked it, and teh hold was lifted the same aftenroon. site is live again, what a scare. thank u thank u thank u

    thumbsup

    1 0 helpful

Reply to this topic

Sign in or create an account to reply.