0

Recently I had my Google Ads telling me that my ad is disabled because the destination is not resolving. The ad seems to actually be running, and my website is loading, however as I was digging into this, it appears there is something wrong with how the DNS (doesn't) resolve.

In Plesk the domain receives the following error: "domain name does not resolve or resolves to a different IP address".

Domain Records in Plesk:

Host               TTL  Record type Value
website.com.        NS  ns2.website.com.
website.com.        NS  ns1.website.com.
website.com.        MX (20) //////deleted////////
website.com.        MX (10) //////deleted////////
www.website.com.        CNAME   website.com.
ftp.website.com.        CNAME   website.com.
ipv4.website.com.       A   IP ADDRESS #1
website.com.            A   IP ADDRESS #1
ns2.website.com.        A   IP ADDRESS #1
ns1.website.com.        A   IP ADDRESS #1
_dmarc.website.com.     TXT //////deleted////////
website.com.            TXT //////deleted////////
protonmail._domainkey.website.com.      TXT //////deleted////////
_acme-challenge.website.com.        //////deleted////////
website.com.        TXT //////deleted////////
website.com.        TXT //////deleted////////

I used mxtoolbox.com to see what kind of issues there were. It reported:

  • dmarc - Unable to get response from name servers within timeframe
  • dmarc - No DMARC Record Found
  • mx - No DMARC Record Found
  • mx - Not able to get a response from name servers within timeframe
  • mx - DMARC Quarantine/Reject policy not enabled dns - Less than Two Name Servers Found
  • dns - SOA expire value out of recommended range

I did setup DMARC for protonmail for this domain and it is currently working. In the registrar, it is setup to use both ns1.website.com and ns2.website.com

2
  • 1
    We can't really help without knowing your domain name. Also, the information you are blanking out is in the public record any way, so not sure if it helps.
    – davidgo
    Commented May 17, 2023 at 1:27
  • the website is: axekpr.com
    – Gustafson
    Commented May 23, 2023 at 18:00

1 Answer 1

1

Your domain name appears to be working OK - however you may well be having intermittent issues with your nameserver (singular - this is important and I'll get to it) which could have caused Google to have an issue when it queried your domain name.

There are 2 things of particular concern with your setup -

  1. Your name servers are subdomains of your main domain. This is a legitimate setup but required a deeper understanding of DNS (ie you need to know about glue records - and if you are unfamiliar with the term you should not be using subdomains of your domain for a nameserver unless you are only learning stuff). I have spent close to a month going back-and-forth with a large, well known registrar and their helpdesk had no clue about these. In short, don't use ns1.axekpr.com and ns2.axekpr.com for axekpr.com

  2. Both of your nameservers resolve to the same IP address. THIS IS VERY BAD, is not in accordance with the DNS specification. Best practices have gotten a lot tighter since this - but even going back tp the original RFC920 - from way back in 1984 - the requirement was for at least 2 independent name servers for the domain. If you have multiple nameservers the risks associated with slowdowns/unavailability of a single server are mitigated. If you can't run at least 2 nameservers on 2 different networks, use your registrars nameservers.

If your primary name server is not working properly and able to answer 100% of the queries - and I'm pretty sure its not - you will experience issues with domain resolution, which I believe is happening (intermittently) here. There are 2 additional things to note here -

  • Most nameserver queries use UDP. This means that if something happens to the packet containing your DNS query or the response (and dropped packets is part of the Internet), your nameserver will not respond unless the query is retried.

    I can't say for sure that your nameserver is dropping queries, but it is very slow - I'm getting response times of around 5 seconds when querying your nameserver directly. That is 5-15 times longer then I would expect - even taking into account that my latency is 130ms. Queries to other authorative nameservers in your country typically answer in 200-900ms. This is indicative that your single nameserver is not up to snuff and is likely dropping queries.

  • Some nameserver queries (longer ones) use TCP. If your firewall does not allow TCP queries your nameserver may appear to work but might not actually be working properly. YOUR NAMESERVER DOES NOT APPEAR TO BE ACCEPTING TCP CONNECTIONS This could well be the source of some of your problems.

While I did experience a timeout trying to query www.axekpr.com I was not able to reproduce this problem, so it was difficult to look into it further - especially without putting additional load on your server at a level that should not be done without explicit permission and in the expectation that it will deny legitimate traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.