Website inaccessible with domain name, but not IP (Problem for + 10 days)

Question

QRD

I can access my webiste with IP address but not domain (altum.fo). I'm using a small mandatory local registrar (okisnavn.fo) but hosting it on AWS Route 53. I've changed the NS records on the registrar to given NS records for Route 53 and added a A record to Route 53 pointing to a static IP that the webserver running my webiste is on (AWS Lightsail).

Hosted Zone and Records

I have the following records on Route 53

The NS records from Route 53 are also registered on the domain registrar as a WHOIS lookup shows:

Name Server: NS-70.AWSDNS-08.COM
Name Server: NS-1365.AWSDNS-42.ORG
Name Server: NS-997.AWSDNS-60.NET
Name Server: NS-1879.AWSDNS-42.CO.UK

My app instance on AWS Lightsail is attached to the static IP 18.201.0.238 which the A record at Route 53 is pointing too.

DNS checkers and troubleshooting

I've used a multitude of DNS checkers and some of the records are found by some servers but never all servers. This is the case for DNS Propagation Checker when looking for A and NS records. I've been told to use dnsviz.net analyis which gives these results: DNS viz analysis results but i am not able to understand what the errors are as i am not (as you might have guessed) experienced in running/hosting/registering a website domain.

Timeline

1. Registered my domain early in August of this year
2. Made a Hosted Zone on AWS Route 53 in 2022-09-01
3. Changed NS records at domain registrar on the same day
4. Created Lightsail instance and attached static IP the day after (2022-09-02)
5. Added A record for static IP to Route 53

Help

I'm at a loss. I cannot comprehend what is going wrong as i am not able to pin point at what stage i'm doing a mistake or at what point of the DNS request the error occurs. Any pointers, hints or debugging help will be greatly appreciated.

Answer 1

Your DNSViz output at https://dnsviz.net/d/altum.fo/YyCEnw/dnssec/ shows a DNSSEC problem.

You can see it on left (but the picture on the right is quite clear with a dashed line between fo and altum.fo:

Delegation status Bogus (1)

fo to altum.fo

In short, the registry has a DS record for your domain but you don't have the corresponding DNSKEY record in your zone, so it breaks resolution for all validating resolvers, and at least the 2 biggest public ones are validating.

You can see it in whois too:

DNSSEC: signedDelegation

So you shouldn't wait, because time will not solve anything by itself as you have a zone misconfigured. You have a DNSSEC problem you need to fix. If you don't understand any of this, go to your registrar and find out how to make it remove DS records at registry. After that wait at least one hour (the current TTL on the DS record for your name on registry authoritative nameservers) before retrying. But you can also do a test in the meantime with DNSViz, it should see everything has cleared out.

Later you should also try to figure out why/how you arrived in this situation, was DNSSEC expected or not, etc? If you don't master your DNS content, you risk anything like that happening again and hence breaking everything.

In any cases, for DNS problems your first point of contact should be your DNS provider that should be able to explain the problem to you, and in a lesser range, your registrar.