I want to point my subdomain (w.example.com
) to (ns1.w.example.com
)
NS w.example.com directs to ns1.w.example.com.
A ns1.w.example.com directs to 192.0.2.139
>> dig w.example.com
; <<>> DiG 9.10.3-P4-Ubuntu <<>> w.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20571
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;w.example.com. IN A
;; Query time: 195 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Thu Feb 14 12:10:13 UTC 2019
;; MSG SIZE rcvd: 43
Why is it breaking DNS resolution & let me know the proper way to point my subdomain (w.example.com
) to (ns1.w.example.com
)
And what it is the proper way to do this?
dig
with@
option to specify which nameserver you query otherwise when troubleshooting things you may get replies from some other nameserver than the one you are expecting. And you always need to first check things at authoritative nameservers for your zone, then at recursive ones.SERVFAIL
indicate a major error and if it is on a nameserver you control you should first head to its logfiles and read there what is happening. It could also be DNSSEC related in which case add+cd
to yourdig
invocation to make sure to disable DNSSEC for your first tests.NS
records, as well as potential glues withA
andAAAA
) or just make a specific name resolve? In the second case you do not need delegation, as there is no one-to-one mapping between "dots" in a name and delegation. In theexample.com
zone you can without problems havens1.w.example.com IN A 192.0.2.139
directly without the need of anyNS
records (no delegation).dig
to analyse the problem trydig +trace @8.8.8.8 w.example.com
anddig +trace @8.8.8.8 ns1.w.example.com
, then you will see where it breaks (on condition that there's only one NS for w).dig
with@
and+trace
at the same time does not make sense, as@
will not be taken into account since+trace
forces normal resolution process starting at root nameserver. What needs to be tested first is directly at authoritative nameserver and only later at recursive ones. And please remember that there is not only8.8.8.8
in the world, but also1.1.1.1
,9.9.9.9
,80.80.80.80
or64.6.64.6
among many others. Anyway it is still preferable to test local recursive ones first, specially if you can control them (bypassing any cache issues, etc.)