Sign in

The Clients .io Domain Vanished From The Internet After Turning On DNSSEC. Did I Break It?

Solveddnsdomainsnxdomain11 replies · 431 views · started
Reply
Accepted solution by Xavi M. — hmmm when you move DNS providers, the new zone satrts empty unless u import it. Run dig A example.com @new ns server directly against the…
  1. Noor Nakamura
    @noor_lambda

    hmmmm ok yesterday i finished turning on DNSSEC for teh clients .io domain. felt proud of myslef. this morning i opened teh site and got this:

    This site can't be reached

    This site can't be reached
Check if there is a typo in my-shop-site.example.
If spelling is correct, try running Windows Network Diagnostics.
DNS_PROBE_FINISHED_NXDOMAIN

    It says the sevrers IP address could not be found, DNS_PROBE_FINISHED_NXDOMAIN. Same thing on every device at home 😂 The registrar dashboard shows teh domain as active and the records look right to me. Ive read everything about propagation but this feels different. How do i tell if its just waiting or if i actually broke smth??

    cry

    2
  2. Xavi M.
    @xavi_patch

    hmmmm quick q did you check the WHOIS status for anything like clientHold? ??

    6 0 helpful
  3. Noor Nakamura
    @noor_lambda
    in reply to @xavi_patch

    ahh right dig +trace for teh client's .io domain goes through the TLD servers and then hits the new nameservers, which answer NXDOMAIN. so the zone is empty? hope thats enough info 😅

    1 0 helpful
  4. Rowan
    @rlopez
    in reply to @noor_lambda

    ahh classic start from teh top of the chain: dig +trace example.com follows the delegation from teh root servers down. if it stops at the TLD servers with no NS records, the registrar doesnt have ur nameservers set ;) if it reaches your nameservers but they return NXDOMAIN, the zone itself is missing or the record isnt there. lmk how it goes

    0 1 helpful
  5. Freya Ziegler
    @fziegler

    check the registry sattus with a WHOIS lookup 🤷 statuses like clientHold or serverHold mean the domain is removed from DNS, commonly after a late renewal or an unverified registrant email address. look for a verification email from teh registrar and cmoplete it; the hold usually lifts shortly after.

    0 2 helpful
  6. Aiden U.
    @aiden.ueda68

    oh ive been there lol if DNSSEC is involved: after changing nameservers, teh old DS record at teh registrar no longer matches teh new zone's keys. validating resolvers then refuse to answer, and many users see the site as gone, remove the DS record at teh registrar, or publish teh new DS from your new DNS provider. worked for me anyway 🤷

    20 0 helpful
  7. Xavi M.
    @xavi_patch
    Accepted solution

    hmmm when you move DNS providers, the new zone satrts empty unless u import it. Run dig A example.com @new-ns-server directly against the new nameserver 🙏 If that returns nothing, recreate the records there before blaming propagation.

    lol

    2 7 helpful
  9. Xavi M.
    @xavi_patch

    wait what everyone keeps saying this but nobody posts proof but hey ymmv

    2 2 helpful
  10. Noor Varga
    @nvarga

    nah tbh propagation does get blamed for everything, but sometimes it really is just caching. If teh records are correct at the authoritative servres, waiting one TTL is a valid answer before tearing things apart. idk maybe im wrong lol

    38 2 helpful
  12. Noor Nakamura
    @noor_lambda
    in reply to @xavi_patch

    @xavi_patch dude removed teh old DS record at the registrar and resolution started working everywhere. DNSSEC will be re-enabled carefully later.. 😤 huge thanks.

    1 0 helpful

Reply to this topic

Sign in or create an account to reply.