1

I have domain example.com, which is registered in czech domain provider and it's nameservers are linked to AWS Route53.

I am hosting it from my S3 bucket. This setup recently stopped working and I can't figure out what went wrong (no changes from my side).

  1. Why is AWS nslookup working and Google one is not? (see below)
  2. What is the issue with dig +trace @8.8.8.8 example.com? (last command)

AWS Route53 Settings

enter image description here

Domain settings:

whois example.com

nsset: NS-PAVELSKRIPAL-CZ
nserver: ns-1302.awsdns-34.org
nserver: ns-1681.awsdns-18.co.uk
nserver: ns-415.awsdns-51.com
nserver: ns-551.awsdns-04.net
registrar: REG-WEB4U
created: 07.03.2018 23:06:05
changed: 09.03.2018 11:09:24

Nslookup succeed (AWS)

Query to Route53 dns server works (server name taken from AWS Route53):

nslookup example.com ns-1302.awsdns-34.org.

Server: ns-1302.awsdns-34.org.
Address: 205.251.197.22#53

Name: example.com
Address: 52.216.94.50

Nslookup fails (Google)

Query to Google DNS fails:

nslookup example.com 8.8.8.8

Server: 8.8.8.8
Address: 8.8.8.8#53

server can't find example.com: SERVFAIL

Dig SERVFAIL

Dig command displays SERVFAIL:

dig example.com

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 31793
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;example.com. IN A

;; Query time: 131 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Apr 23 11:32:02 CEST 2020
;; MSG SIZE rcvd: 44

Dig +trace

And I am not able to analyze this dig trace command. I cannot see where is the issue.

dig +trace @8.8.8.8 example.com

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> +trace @8.8.8.8 example.com
; (1 server found)
;; global options: +cmd
. 85845 IN NS g.root-servers.net.
. 85845 IN NS k.root-servers.net.
. 85845 IN NS h.root-servers.net.
. 85845 IN NS c.root-servers.net.
. 85845 IN NS d.root-servers.net.
. 85845 IN NS l.root-servers.net.
. 85845 IN NS m.root-servers.net.
. 85845 IN NS i.root-servers.net.
. 85845 IN NS f.root-servers.net.
. 85845 IN NS j.root-servers.net.
. 85845 IN NS a.root-servers.net.
. 85845 IN NS b.root-servers.net.
. 85845 IN NS e.root-servers.net.
. 85845 IN RRSIG NS 8 0 518400 20200505170000 20200422160000 48903 . p0dM/vuSKrWpnMwMMqOcqI5wGiSuwu7M0QdlhfHXSKwd7xfTWP2w/l+T 5mEVmC0bflkUqXvSO5As3KgHU6H/xCIA+CpHVCqG7PqSqVz0ZXpswWNs yDCaqSa0OvpQ8xdz56m30cGcEuOTBKcenHcgG5oEPWnK6BRTpNzpsIlm ItB/8lc2JPfEEfeJank0H3VHPlzxVY43wwO8Ypv172o/7Km+6jG0h0Hf fgnChk6+waNcNvf+AbGmn3lob/5BH03ehJ5HotEd7YRdeb4dEf4ow5sP uwpiblIifXk2CrOYAFuAiU+DjYjxFBCdvR+smx+hminsxjC6klf/F2SA aSiVDg==
;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 2 ms

cz. 172800 IN NS b.ns.nic.cz.
cz. 172800 IN NS c.ns.nic.cz.
cz. 172800 IN NS d.ns.nic.cz.
cz. 172800 IN NS a.ns.nic.cz.
cz. 86400 IN DS 20237 13 2 CFF0F3ECDBC529C1F0031BA1840BFB835853B9209ED1E508FFF48451 D7B778E2
cz. 86400 IN RRSIG DS 8 1 86400 20200506050000 20200423040000 48903 . ki1m2J3TYtNnxpmbI6qBXhpyFztJMdPWLQkRL1ri9uUSXC2BAVpw8sh7 UlzEHQKjTwsVfLeK/lLAz+xEcSjQcxS3rcW+vzxVQpG/DMiQZuNmFk8Q bciGQrf2DUw4vzBdTLj/c0rv5RDCrF8nCqABIFw2qbITQJt7qVh3IICY 4IABAlzu5ftmk2Osyek63lldviBsfWcg9IwL3augsvbslToGzPL0h6fy 2iNiRAaH+aBQkxjI9+zhAGRwn+kAEH+MA2c8hlW88mKteOjk8DD1nxzi w164u/i5lfuVQWOoapJEEOaLtr4Jo4m5lq7OBHFWdYamAlYmX4p+0dwC OcZ6+A==
;; Received 626 bytes from 198.41.0.4#53(a.root-servers.net) in 16 ms

example.com. 3600 IN NS ns-415.awsdns-51.com.
example.com. 3600 IN NS ns-551.awsdns-04.net.
example.com. 3600 IN NS ns-1302.awsdns-34.org.
example.com. 3600 IN NS ns-1681.awsdns-18.co.uk.
example.com. 3600 IN DS 21649 5 2 F4CEAE3A81831B64E3D4E1162ACD5172F8C56443179677CDB455F742 F459A8D4
example.com. 3600 IN RRSIG DS 13 2 3600 20200502000508 20200418083531 44987 cz. ntrFNqObEZTSXaZvD3TVvR2GwCxJSiE+gQYBre+rXlCtibqIMAmOp6u8 oow3rQEFuUT+dXUjoHHYbZFaOTyYRQ==
;; Received 330 bytes from 193.29.206.1#53(d.ns.nic.cz) in 1 ms

example.com. 5 IN A 52.216.29.67
example.com. 172800 IN NS ns-1302.awsdns-34.org.
example.com. 172800 IN NS ns-1681.awsdns-18.co.uk.
example.com. 172800 IN NS ns-415.awsdns-51.com.
example.com. 172800 IN NS ns-551.awsdns-04.net.
;; Received 200 bytes from 205.251.194.39#53(ns-551.awsdns-04.net) in 22 ms
7
  • 1
    You are not giving the real name, while the DNS is public, which makes troubleshooting more difficult. Try dnsviz.net/ it is a good tool to troubleshoot online. Commented Apr 23, 2020 at 14:33
  • From your obfuscated traces you have DNSSEC, this is the most probable cause of failure. Easy to check with dig, add +cd, if the SERVFAIL disappear then at a 99.99% probability the issue is with DNSSEC misconfiguration. dnsviz will shine here to show you the problem. But other than that the issue is kind of off topic here as it is not about running a website, the way you presented it. Also for problems like that your first stop should be the DNS provider. Did you ask it about the problems? Commented Apr 23, 2020 at 14:35
  • I was giving the DNS name, but @john-conde edited it :-( The domain is pavelskripal.cz and it's still visible in the configuration image.
    – amra
    Commented Apr 23, 2020 at 16:23
  • 1
    @MeV It was a problem with DNSSEC. It should be supported now: stackoverflow.com/questions/52873371/… There was no solution for that year ago, so I just used Cloudflare service.
    – amra
    Commented Jun 16, 2021 at 8:36
  • 1
    These tools helped: dnssec-analyzer.verisignlabs.com dnsviz.net
    – amra
    Commented Jun 16, 2021 at 8:48

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.