Submitted by kappler0 on Tue, 11/20/2012 - 00:27 Pro Licensee
Hi there,
When running a test with intodns.com I am seeing errors with the nameservers. The errors that i see are:
-- Mismatched NS records WARNING: One or more of your nameservers did not return any of your NS records. -- DNS servers responded ERROR: One or more of your nameservers did not respond: The ones that did not respond are: 98.142.218.110 -- Missing nameservers reported by your nameservers You should already know that your NS records at your nameservers are missing, so here it is again: ns1.dealbent.net. ns2.dealbent.net.
( The full report can be seen here: http://www.intodns.com/dealbent.net )
So, i am a little confused on why these errors would be reported.. I have A records set up and the host ip's have been set at the registrar for weeks now. Am i missing something obvious here? Thanks!
scott
Status:
Active
Comments
Submitted by Locutus on Tue, 11/20/2012 - 04:17 Comment #1
My analysis: The IP address "98.142.218.110" is not responding to DNS requests.
First a hint. That IP is configured for both ns1 and ns2 at your domain. That is - while possible for some TLDs - bad practice, since it defeats the purpose of nameserver redundancy. For example, for .de domains you must have at least two nameservers which must reside in different /24 networks.
The IP address is not replying to PING or TRACEROUTE either. Is the IP correct?
If yes, make sure that BIND is running on the machine and listening on UDP port 53 on the external IP. You can find that out like this:
Submitted by kappler0 on Tue, 11/20/2012 - 10:41 Pro Licensee Comment #2
Thanks for the reply - I am aware of the ns1 / 2 being on the same IP - i plan to have a second server soon to be the second, last time i attempted this (with virtualmin) i ran into issues and never got back to it. However, that ip as well as the other private ip's all seem to be listening. Any other ideas? Thank you!
Submitted by kappler0 on Tue, 11/20/2012 - 10:57 Pro Licensee Comment #3
Update - this may in-fact be a bug. I started looking around and in /etc/named.conf the records are showing the OLD servers primary IP address, not the new servers IP. I am going to edit this ip on all lines and see if that corrects it, but i think there is something else i am missing? Thanks
Submitted by Locutus on Tue, 11/20/2012 - 11:02 Comment #4
Yep, BIND seems to be listening A-okay.
Since also ping and traceroute don't reach the IPs, it is possible that some firewall is blocking access. Do you know of any firewall operated by your hoster?
Otherwise, you can query the status of a locally installed firewall in most Linux distributions using
iptables -L -n. You might want to post its output here if you have trouble interpreting it. :)I'm attaching the output of a traceroute below, maybe the last hop can tell you if the route stops right before your server, or along the way in your hoster's network.
Submitted by Locutus on Tue, 11/20/2012 - 11:04 Comment #5
Where exactly in your named.conf did you find the wrong IP address? Since BIND seems to be listening okay on the IP that your domain registrar reports, and also pings don't reach that IP, there's probably something else wrong.
Is "98.142.218.110" the correct IP?
Submitted by kappler0 on Tue, 11/20/2012 - 11:38 Pro Licensee Comment #6
Hmmm.. No firewall other than my own which isn't blocking anything i am aware of... the tracert appears to stop right before my FW. I will double-check but there are no blocking rules except for IP's outside the USA.
The named.conf file had these for each: (the .110 ip was the old, i changed them all)
zone "fitmedwellness.com" { type master; file "/var/named/fitmedwellness.com.hosts"; allow-transfer { 127.0.0.1; localnets; 98.142.218.110; };"98.142.218.110" is the correct IP. I can ping the ip from my pc in starbucks now too...
Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\Scott Kappler>ping 98.142.218.110 Pinging 98.142.218.110 with 32 bytes of data: Reply from 98.142.218.110: bytes=32 time=13ms TTL=53 Reply from 98.142.218.110: bytes=32 time=12ms TTL=53 Reply from 98.142.218.110: bytes=32 time=17ms TTL=53 Reply from 98.142.218.110: bytes=32 time=11ms TTL=53 Ping statistics for 98.142.218.110: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 11ms, Maximum = 17ms, Average = 13msThis is strange... I am at a loss.. Thanks a lot...
Submitted by Locutus on Tue, 11/20/2012 - 11:45 Comment #7
The contents of your named.conf, here the allow-transfer directive, has no influence on the issue you're seeing at the moment.
I will double-check but there are no blocking rules except for IP's outside the USA.
Well, I am outside the USA (as are my root servers). ;) You might want to check if you're blocking e.g. my server's IP 176.9.191.26 or my home one 87.79.76.199, both of which cannot ping your IP.
Submitted by kappler0 on Tue, 11/20/2012 - 11:53 Pro Licensee Comment #8
Yes you were blocked..
Nov 20 12:34:37 WAN 87.79.76.199 98.142.218.110 ICMP Nov 20 12:32:49 WAN 87.79.76.199 98.142.218.110 ICMP
I am wondering if there is an issue with the accuracy of intodns.com now -
I tried a test from here: http://www.webdnstools.com/dnstools/chk-domain and do not get the same errors...
What do you think?
Submitted by Locutus on Tue, 11/20/2012 - 11:58 Comment #9
Well if your firewall blocked me, it's very likely it's also blocking IntoDNS during its test, considering it reported your nameserver as unreachable. :) I personally found IntoDNS to be quite reliable.
So before doing any further steps, you should probably remove any source IP block rules from your firewall and try IntoDNS again.
Submitted by kappler0 on Tue, 11/20/2012 - 12:01 Pro Licensee Comment #10
Thanks - feel like a chicken chasing my own tail.. :) Sorry for the trouble... I will let you know if it persists after..