I am currently investigating moving some records to a new set of nameservers, and in doing the research to be prepared for it have come up against a confusing mismatch. A bit of background on the situation -
- it's a
.com.au
domain, if that is of note (don't think it is). - There are several parties involved here - the webhosting company, who I originally had the impression was providing the nameservers; the registrar, who I am starting to think might actually be the ones providing them; and the company I work for, which has an internal DNS server which overrides one of the records (again, I don't think this should matter, I am making my whois/nslookup queries using online tools outside our network to try to ensure this doesn't complicate things).
- To keep the question general, lets call these parties and their nameservers HostCo, RegCo and OurCo, and call the domain in question
*.ourco.example
.
Here are the two conflicting results I am seeing (some obfuscation):
Whois response for ourco.example:
Domain Name ourco.example
Last Modified 12-Apr-2014 11:39:38 UTC
Registrar ID RegCo
Registrar Name RegCo
Status ok
Registrant OURCO PTY LTD
Registrant ID ACN ### ### ###
Eligibility Type Company
Registrant Contact ID JB#######
Registrant Contact Name Joe Bloggs
Registrant Contact Email [email protected]
Tech Contact ID CO2415740
Tech Contact Name Chris O\'Kelly
Tech Contact Email [email protected]
Name Server ns1.hostco.example
Name Server IP ###.###.###.###
Name Server ns2.hostco.example
Name Server IP ###.###.###.###
which suggests HostCo hosts the nameservers, and
>nslookup - 8.8.8.8
Default Server: google-public-dns-a.google.com
Address: 8.8.8.8
> set querytype=soa
> ourco.example
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
ourco.example
primary name server = ns1.regco.example
responsible mail addr = hostmaster.ourco.example
serial = 20030501
refresh = 10800 (3 hours)
retry = 3600 (1 hour)
expire = 604800 (7 days)
default TTL = 10800 (3 hours)
which suggests RegCo hosts them.
I've done some further investigation; reading this question led me to a DNS propogation tool designed by David Precious. This tool returns the RegCo nameservers and advises "All responding servers agreed on the same answer".
Furthermore, I tried to nslookup the domain on HostCo's nameservers, like so:
>nslookup ourco.example ns1.hostco.example
(root) nameserver = L.ROOT-SERVERS.NET
(root) nameserver = M.ROOT-SERVERS.NET
(root) nameserver = A.ROOT-SERVERS.NET
(root) nameserver = B.ROOT-SERVERS.NET
(root) nameserver = C.ROOT-SERVERS.NET
(root) nameserver = D.ROOT-SERVERS.NET
(root) nameserver = E.ROOT-SERVERS.NET
(root) nameserver = F.ROOT-SERVERS.NET
(root) nameserver = G.ROOT-SERVERS.NET
(root) nameserver = H.ROOT-SERVERS.NET
(root) nameserver = I.ROOT-SERVERS.NET
(root) nameserver = J.ROOT-SERVERS.NET
(root) nameserver = K.ROOT-SERVERS.NET
Server: UnKnown
Address: ###.###.###.###
Name: ourco.example
Address: ###.###.###.###
Which suggests that HostCo just points back to the root internet nameservers for that address... I think.
Finally, when I log onto RegCo's domain management tools, it lists ns1.hostco.example
and ns2.hostco.example
as the nameservers for the domain in both the "Domain Info" section and the section wherein I set nameservers. In the "Update DNS Details" section I have the details for all the hosts, with appropriate MX, CNAME and A records to what I expect.
My theory is that the information on RegCo's nameserver section was entered incorrectly and that causes the domain info and whois to be wrong too; if so then the settings in the "Update DNS Details" are what is being used and I can safely say the current nameserver is with RegCo. The only flaw I see with this theory is that if it were true, wouldn't it be incorrectly pointing DNS requests to HostCo, and wouldn't that mean things shouldn't be working (they are)?
Can anyone confirm or deny my theory?
Edit the first
In case this was not yet confusing enough, here's the results of a dig +trace suggested by closetnoc:
dig @8.8.8.8 ourco.example +trace any
; <<>> DiG 9.7.0-P1 <<>> @8.8.8.8 ourco.example +trace any
; (1 server found)
;; global options: +cmd
. 6055 IN NS f.root-servers.net.
. 6055 IN NS j.root-servers.net.
. 6055 IN NS a.root-servers.net.
. 6055 IN NS c.root-servers.net.
. 6055 IN NS m.root-servers.net.
. 6055 IN NS k.root-servers.net.
. 6055 IN NS g.root-servers.net.
. 6055 IN NS b.root-servers.net.
. 6055 IN NS h.root-servers.net.
. 6055 IN NS d.root-servers.net.
. 6055 IN NS i.root-servers.net.
. 6055 IN NS l.root-servers.net.
. 6055 IN NS e.root-servers.net.
;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 172 ms
au. 172800 IN NS a.au.
au. 172800 IN NS b.au.
au. 172800 IN NS r.au.
au. 172800 IN NS s.au.
au. 172800 IN NS u.au.
au. 172800 IN NS v.au.
au. 172800 IN NS w.au.
au. 172800 IN NS x.au.
au. 172800 IN NS y.au.
au. 172800 IN NS z.au.
;; Received 493 bytes from 199.7.83.42#53(l.root-servers.net) in 993 ms
com.au. 86400 IN NS z.au.
com.au. 86400 IN NS w.au.
com.au. 86400 IN NS y.au.
com.au. 86400 IN NS x.au.
;; Received 273 bytes from 202.12.31.141#53(v.au) in 1038 ms
ourco.example. 14400 IN NS ns2.hostco.example.
ourco.example. 14400 IN NS ns1.hostco.example.
;; Received 111 bytes from 37.209.194.5#53(x.au) in 998 ms
ourco.example. 14400 IN TXT "v=spf1 +a +mx +ip4:###.###.###.### ?all"
ourco.example. 14400 IN MX 0 mail.ourco.example.
ourco.example. 86400 IN SOA ns1.hostco.example. security.bitcloud.com.au. 2013051700 86400 7200 3600000 86400
ourco.example. 86400 IN NS ns2.hostco.example.
ourco.example. 86400 IN NS ns1.hostco.example.
ourco.example. 14400 IN A ###.###.###.###
;; Received 236 bytes from ###.###.###.####53(ns1.hostco.example) in 158 ms
which undermines my theory that the registrar holds the nameservers
dig +trace
now and edit the Q with the results. Nothing's been changed on this in years (it was all set up before I started here) so apparently it's been working like this, but before we do make changes I want to be sure of why it is working so I can revert if needed.