OFFICIAL GUIDE

DNS problems

Diagnosing NXDOMAIN, delegation, glue, DNSSEC, and cluster issues.

Separate four questions: does the zone exist? do the authoritative servers respond? did the parent delegate correctly? do public resolvers see the same information?

Direct authority

Terminal

dig @IP-NS1 example.com SOA +norecurse +comments
dig @IP-NS2 example.com SOA +norecurse +comments

Public delegation

Terminal

dig example.com NS +trace
dig @1.1.1.1 example.com NS +noall +answer
dig @8.8.8.8 ns1.example.com A +noall +answer

DNSSEC

Terminal

dig @1.1.1.1 example.com DS +dnssec +noall +answer +comments
dig @1.1.1.1 example.com SOA +dnssec +comments

Signed does not mean validatedA zone can publish RRSIG and DNSKEY and still lack end-to-end DNSSEC if the DS is not present in the parent.

← PreviousCloud firewall Next →Diagnostic commands