Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am currently investigating moving some records to a new set of nameservers, and in doing the research to be prepared for it have come up against a confusing mismatch. A bit of background on the situation -

  • it's a domain, if that is of note (don't think it is).
  • There are several parties involved here - the webhosting company, who I originally had the impression was providing the nameservers; the registrar, who I am starting to think might actually be the ones providing them; and the company I work for, which has an internal DNS server which overrides one of the records (again, I don't think this should matter, I am making my whois/nslookup queries using online tools outside our network to try to ensure this doesn't complicate things).
  • To keep the question general, lets call these parties and their nameservers HostCo, RegCo and OurCo, and call the domain in question *

Here are the two conflicting results I am seeing (some obfuscation):

Whois response for

Domain Name
Last Modified   12-Apr-2014 11:39:38 UTC
Registrar ID    RegCo
Registrar Name  RegCo
Status  ok
Registrant  OURCO PTY LTD
Registrant ID   ACN ### ### ###
Eligibility Type    Company
Registrant Contact ID   JB#######
Registrant Contact Name Joe Bloggs
Registrant Contact Email
Tech Contact ID CO2415740
Tech Contact Name   Chris O\'Kelly
Tech Contact Email
Name Server
Name Server IP  ###.###.###.###
Name Server
Name Server IP  ###.###.###.###

which suggests HostCo hosts the nameservers, and

>nslookup -
Default Server:

> set querytype=soa

Non-authoritative answer:
        primary name server =
        responsible mail addr =
        serial  = 20030501
        refresh = 10800 (3 hours)
        retry   = 3600 (1 hour)
        expire  = 604800 (7 days)
        default TTL = 10800 (3 hours)

which suggests RegCo hosts them.

I've done some further investigation; reading this question led me to a DNS propogation tool designed by David Precious. This tool returns the RegCo nameservers and advises "All responding servers agreed on the same answer".

Furthermore, I tried to nslookup the domain on HostCo's nameservers, like so:


(root)  nameserver = L.ROOT-SERVERS.NET
(root)  nameserver = M.ROOT-SERVERS.NET
(root)  nameserver = A.ROOT-SERVERS.NET
(root)  nameserver = B.ROOT-SERVERS.NET
(root)  nameserver = C.ROOT-SERVERS.NET
(root)  nameserver = D.ROOT-SERVERS.NET
(root)  nameserver = E.ROOT-SERVERS.NET
(root)  nameserver = F.ROOT-SERVERS.NET
(root)  nameserver = G.ROOT-SERVERS.NET
(root)  nameserver = H.ROOT-SERVERS.NET
(root)  nameserver = I.ROOT-SERVERS.NET
(root)  nameserver = J.ROOT-SERVERS.NET
(root)  nameserver = K.ROOT-SERVERS.NET
Server:  UnKnown
Address:  ###.###.###.###

Address:  ###.###.###.###

Which suggests that HostCo just points back to the root internet nameservers for that address... I think.

Finally, when I log onto RegCo's domain management tools, it lists and as the nameservers for the domain in both the "Domain Info" section and the section wherein I set nameservers. In the "Update DNS Details" section I have the details for all the hosts, with appropriate MX, CNAME and A records to what I expect.

My theory is that the information on RegCo's nameserver section was entered incorrectly and that causes the domain info and whois to be wrong too; if so then the settings in the "Update DNS Details" are what is being used and I can safely say the current nameserver is with RegCo. The only flaw I see with this theory is that if it were true, wouldn't it be incorrectly pointing DNS requests to HostCo, and wouldn't that mean things shouldn't be working (they are)?

Can anyone confirm or deny my theory?

Edit the first

In case this was not yet confusing enough, heres the results of a dig +trace suggested by closetnoc :

dig @ +trace any

; <<>> DiG 9.7.0-P1 <<>> @ +trace any
; (1 server found)
;; global options: +cmd
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
.                       6055    IN      NS
;; Received 228 bytes from in 172 ms

au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
au.                     172800  IN      NS
;; Received 493 bytes from in 993 ms                 86400   IN      NS                 86400   IN      NS                 86400   IN      NS                 86400   IN      NS
;; Received 273 bytes from in 1038 ms        14400   IN      NS        14400   IN      NS
;; Received 111 bytes from in 998 ms        14400   IN      TXT     "v=spf1 +a +mx +ip4:###.###.###.### ?all"        14400   IN      MX      0        86400   IN      SOA 2013051700 86400 7200 3600000 86400        86400   IN      NS        86400   IN      NS        14400   IN      A       ###.###.###.###
;; Received 236 bytes from ###.###.###.####53( in 158 ms

which undermines my theory that the registrar holds the nameservers

share|improve this question
Damn I am confused! You must be too. One other ting I like to do is a dig with +trace. I am not sure that it will help much except that I trust this more than most. Have there been any changes of late? Otherwise I have to think on this for a while. Noting is coming to mind just yet. Great question BTW. Up voting now. – closetnoc Apr 23 '14 at 3:01
@closetnoc Well I am glad it's not just me! I'll try the dig +trace now and edit the Q with the results. Nothing's been changed on this in years (it was all set up before I started here) so apparently it's been working like this, but before we do make changes I want to be sure of why it is working so I can revert if needed. – Chris O'Kelly Apr 23 '14 at 3:33
Gotcha! Sounds like it was rigged but works anyway. It is probably best to clean it up at some point. I am a semi-retired IT consultant and one way to CYA is to CYA! So it is a good idea to make sure you can revert just in case. – closetnoc Apr 23 '14 at 3:43
Looks like your hosting company is the authority. I should have told to add any at the end of the dig command. My apologies! These are the hazards of getting old... I would repeat the dig command with any and look for SOA to be sure. It may be that your registrar is not the authority which may mean that you can edit the ns entries and point them to use your hosting companies ns servers. – closetnoc Apr 23 '14 at 3:49
@closetnoc Looks like you're right, it is the hosting company that is both the authority and the primary NS (security.bitcloud is mentioned but I am guessing that's the server the hosting company, in turn, uses). Confusingly the nameserver entries on the registrar already point at the hosting company, so I am not sure where those nslookup results were coming from (though they were marked non-authorative). I suppose I will just document it as a possible source of trouble and if we have issues after the change we'll update the entries on RegCo too... – Chris O'Kelly Apr 23 '14 at 4:02

1 Answer 1

up vote 2 down vote accepted

Your situation is an odd one and your question more than intriguing. I imagine that this question can be helpful because this would be a really confusing situation to anyone. I do this everyday and it eluded me even though there were hints right in the question that were easy to overlook.

When you use nslookup or whois, it is possible that the data returned is a non-authoritative answer which means that it it is not the gold-standard. Normally you want an authoritative answer but whether any answer is authoritative or non-authoritative is not always clear. The whois result was correct and the nslookup was non-authoritative. But how are you to really know what is going on without guessing? What if you want to be dead sure?

I use dig +trace any to know for sure. This command does a trace from the root name servers through to the domain name authority for your site. In this way, you can know what entries are correct. You can look for a SOA (statement of authority) records, A records, NS records, MX records, and so forth to know which set of DNS entries are the ones that are authoritative.

In this case, your host company is the authority and the records at the registrar are incorrect. You will have to log onto you registrar's control panel and check to make sure that the entries are corrected. In this case, any A record is likely incorrect and should be deleted to be safe. As well, you can change the name servers to be the domain name servers for your host. If there is an MX record, you can remove it, but I would make sure it exists within your host DNS control panel first or very shortly after.

It appeared that the registrars DNS entries was confusing the issue. It is possible that this data could interrupt service for a user. Correcting and/or removing these DNS entries should clear up any issues and may solve problems that you are unaware of.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.