I can access my webiste with IP address but not domain (altum.fo). I'm using a small mandatory local registrar (okisnavn.fo) but hosting it on AWS Route 53. I've changed the NS records on the registrar to given NS records for Route 53 and added a A record to Route 53 pointing to a static IP that the webserver running my webiste is on (AWS Lightsail).

Hosted Zone and Records

I have the following records on Route 53 enter image description here

The NS records from Route 53 are also registered on the domain registrar as a WHOIS lookup shows:

Name Server: NS-70.AWSDNS-08.COM
Name Server: NS-1365.AWSDNS-42.ORG
Name Server: NS-997.AWSDNS-60.NET
Name Server: NS-1879.AWSDNS-42.CO.UK

My app instance on AWS Lightsail is attached to the static IP which the A record at Route 53 is pointing too. enter image description here

DNS checkers and troubleshooting

I've used a multitude of DNS checkers and some of the records are found by some servers but never all servers. This is the case for DNS Propagation Checker when looking for A and NS records. I've been told to use dnsviz.net analyis which gives these results: DNS viz analysis results but i am not able to understand what the errors are as i am not (as you might have guessed) experienced in running/hosting/registering a website domain.


  1. Registered my domain early in August of this year
  2. Made a Hosted Zone on AWS Route 53 in 2022-09-01
  3. Changed NS records at domain registrar on the same day
  4. Created Lightsail instance and attached static IP the day after (2022-09-02)
  5. Added A record for static IP to Route 53


I'm at a loss. I cannot comprehend what is going wrong as i am not able to pin point at what stage i'm doing a mistake or at what point of the DNS request the error occurs. Any pointers, hints or debugging help will be greatly appreciated.

  • Based on your last (now deleted) question, you just changed your NS records yesterday, right? Sep 13, 2022 at 10:02
  • In the future, it is better practice to edit your question rather than delete it and ask a new one. Sep 13, 2022 at 10:03
  • For me, your website it at least partly working: curl --head http://altum.fo shows HTTP/1.1 200 OK. However https://altum.fo doesn't have a valid security certificate. curl --head http://www.altum.fo shows curl: (6) Could not resolve host: www.altum.fo but that may resolve itself in 48 hours because each of your name servers is returning the value correctly now: dig www.altum.fo @ns-1879.awsdns-42.co.uk. shows www.altum.fo. 300 IN CNAME altum.fo. Sep 13, 2022 at 10:08
  • Yes, i did change the records on my domain registrar to the records of my Route 53 hosted zone, but these NS records had been 'active' for + 10 days. The reason you cannot get a https response is that i do not have a https certificate as i cannot make this certificate because the certificate tool cannot find the domain (LOL). Could this be relevant to the question? But are you able to access the website through the browser, using altum.fo? Again, thank you very much for your time
    – brendbech
    Sep 13, 2022 at 10:12
  • Yes, I can access it through the browser. Your time-to-live (TTL) on your NS records is set to 172800 (48 hours.) This may just be a matter of waiting that long since you updated them. Sep 13, 2022 at 10:14

1 Answer 1


Your DNSViz output at https://dnsviz.net/d/altum.fo/YyCEnw/dnssec/ shows a DNSSEC problem.

You can see it on left (but the picture on the right is quite clear with a dashed line between fo and altum.fo:

Delegation status Bogus (1)

fo to altum.fo

In short, the registry has a DS record for your domain but you don't have the corresponding DNSKEY record in your zone, so it breaks resolution for all validating resolvers, and at least the 2 biggest public ones are validating.

You can see it in whois too:

DNSSEC: signedDelegation

So you shouldn't wait, because time will not solve anything by itself as you have a zone misconfigured. You have a DNSSEC problem you need to fix. If you don't understand any of this, go to your registrar and find out how to make it remove DS records at registry. After that wait at least one hour (the current TTL on the DS record for your name on registry authoritative nameservers) before retrying. But you can also do a test in the meantime with DNSViz, it should see everything has cleared out.

Later you should also try to figure out why/how you arrived in this situation, was DNSSEC expected or not, etc? If you don't master your DNS content, you risk anything like that happening again and hence breaking everything.

In any cases, for DNS problems your first point of contact should be your DNS provider that should be able to explain the problem to you, and in a lesser range, your registrar.

  • Thank you Patrick, this is exactly the pointer i need!
    – brendbech
    Sep 13, 2022 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.