2

6 days ago, a .com domain was transferred to a new registrar, and the DNS servers changed. Only later did it transpire that the previous registrar had applied DNSSEC records.

The domain is now not resolving in a good number of providers, and in particular Google and OpenDNS.

https://dnschecker.org/#A/theradiologyacademy.com

The new registrar initially kept saying 'give it time'. They seem clueless how to resolve the situation. The old registrar does not recognise the domain any more - its been successfully transferred.

The servers that do recognise the domain, do show the correct new details. The broken ones report NXDOMAIN. The new provider is not using DNSSEC.

also checked here https://dnsviz.net/d/theradiologyacademy.com/dnssec/ with entries being marked as 'bogus'

How can this be resolved? Is there a way I can find out when previous entries will expire?

  • What's your purpose? Do you want to keep old domain rankings in google SERP with new domain? You can use address change tool and 301 redirect in google search console. – seo pine Jun 3 at 13:06
  • Purpose? Transfer the domain name to new provider. My customer used 1&1 and transferred their hosting and domain name to me (as service provider). I use a reseller account at Heart Internet as the container for all customer domains. – Snapey Jun 3 at 13:08
  • In my thought, your purpose is not for google seo, you can consult with old domain company and new domain company. Generally, domain hosting company is supposed to support customer's request. Good luck. – seo pine Jun 3 at 13:11
  • 1
    nothing to do with SEO – Snapey Jun 3 at 14:34
4

it transpire that the previous registrar had applied DNSSEC records.

Normally a registrar does not do things by itself, at least it does not add DNSSEC records (that is typically DS data) unless advised so by the current owner of the domain.

How can this be resolved? Is there a way I can find out when previous entries will expire?

Go immediately to current sponsoring registrar and make it remove DS data at registry. After one day (because the TTL on DS records at .COM registry is one day) the problem will clear itself.

You may want to look at this other similar question here: Long propagation times after transferring a domain name and changing the NS records without disabling DNSSEC where I answered with long explanations.

Of course, you have now learned a very valid lesson: DO NOT TRANSFER between registrars domain names that are DNSSEC enabled. This is an edge case that is currently not well addressed. There are various ways but not a real clear simple solution. If you are not mastering DNSSEC it is probably better to remove it, wait "enough", then transfer it. Otherwise, if you need to keep DNSSEC at all times you need to make sure that your nameservers stay the same and resolve DNSSEC the same during and after the transfer (which may be another good lesson to keep: using your registrar as DNS provider is not necessarily always a good idea, specifically here when you transfer out of it, in most cases it will stop operate the DNS service as soon as the domain leaves it; even if it does not, you then have the problems related to key management inside DNSSEC).

An even better registrar (but I am not sure I know one doing so) would detect, prior to attempt the transfer, that the domain is DNSSEC enabled and at least warn you about that. Until that happens unfortunately you need to double check that yourself before attempting a transfer.

The new provider is not using DNSSEC.

What does provider mean here, the new registrar or the new DNS provider (the registrar can be the DNS provider, but it is still two different jobs)?

Indeed, DNS providers need to explicitly support DNSSEC as they need more than just allowing some specific resource records in the zone file, they also need to maintain the keys and rotate them, compute the signatures either online or offline, etc.

But at the registrar level, at least in .COM, all of them are contractually required to support DNSSEC, because of their contract with ICANN. The specific job of a registrar regarding DNSSEC is just forwarding the data that the owner has input (like DS content) and send it to the registry. It is a one time job (except when you need to change the DS record of course, but in normal DNSSEC setups this happens every year or 2 years typically), so not a big problem.

It may be difficult to be 100% sure before using it if a registrar allows DNSSEC because even if they are all contractually required to do it (in gTLDs at least) it can be more or less simple (going from a fully automated UI that the owner can freely use, to having to contact customer service and send information over email and pray that the human being at the other end understands what it is about.)

| improve this answer | |
  • Heart act as Registrar and DNS provider. I edit the DNS through their admin panel. The problem is caused by IONOS telling my customer that they have subscribed to 'Domain Guard'. When my customer requests to unlock the domain, they do not warn that they should remove domain guard before transfer. The receiving registrar happily takes over the domain and allows the DNS to be changed to their own without warning about DNSSEC. Then their support are ignorant of DNSSEC and can only advise to wait to see if it sorts itself out. Result = 6 days downtime for my customer. – Snapey Jun 3 at 21:33
  • 1
    after almost bullying comments on their support ticket, they finally report; I cannot promise you on 100% but I think that I had the DNSSEC records for this domain name removed. Can you please give it an hour or two, test it and let us know of the result? Google and OpenDNS now recognise this domain and others are coming online also. – Snapey Jun 3 at 21:36
  • dig @a.gtld-servers.net theradiologyacademy.com DS does not show anything anymore so indeed the DS record(s) were removed. You will need to wait up to 24 hours for all caches to expire. – Patrick Mevzek Jun 4 at 0:26
  • "Domain Guard" should be something different if it is just a business name for "registrar lock". A registrar lock is a service to forbid any change to a domain, without some extra special scrutiny. Among other things it should prevent any transfer going on. It is mostly unrelated to DNSSEC. A registrar lock will typically add clientTransferProhibited EPP status (see icann.org/epp for details) which would prevent the new registrar to even start the transfer (the registry would not process its request right there) – Patrick Mevzek Jun 4 at 0:27
  • 1
    " Result = 6 days downtime for my customer. " You may wish later to ponder on the idea of having your registrar being your DNS provider. You can as well use a third party. There is no best solution for all cases, each one has benefits and drawbacks. But at least it is good in all cases to be able to assess the level of support you get (based on the price you pay) and hence arrive at your own conclusions if you believe your provider(s) do a good job for you or not. – Patrick Mevzek Jun 4 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.