-1

I want to point my subdomain (w.example.com) to (ns1.w.example.com)

NS  w.example.com directs to ns1.w.example.com.
A ns1.w.example.com directs to 192.0.2.139

>> dig w.example.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> w.example.com

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20571
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;w.example.com.                        IN      A

;; Query time: 195 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Thu Feb 14 12:10:13 UTC 2019
;; MSG SIZE  rcvd: 43

Why is it breaking DNS resolution & let me know the proper way to point my subdomain (w.example.com) to (ns1.w.example.com)

And what it is the proper way to do this?

11
  • 1
    Always use dig with @ option to specify which nameserver you query otherwise when troubleshooting things you may get replies from some other nameserver than the one you are expecting. And you always need to first check things at authoritative nameservers for your zone, then at recursive ones. Commented Feb 14, 2019 at 14:50
  • 1
    A SERVFAIL indicate a major error and if it is on a nameserver you control you should first head to its logfiles and read there what is happening. It could also be DNSSEC related in which case add +cd to your dig invocation to make sure to disable DNSSEC for your first tests. Commented Feb 14, 2019 at 14:52
  • What do you mean by "point"? Either delegate a subzone to other nameservers (in which case you need proper NS records, as well as potential glues with A and AAAA) or just make a specific name resolve? In the second case you do not need delegation, as there is no one-to-one mapping between "dots" in a name and delegation. In the example.com zone you can without problems have ns1.w.example.com IN A 192.0.2.139 directly without the need of any NS records (no delegation). Commented Feb 14, 2019 at 14:55
  • If you wish to use dig to analyse the problem try dig +trace @8.8.8.8 w.example.com and dig +trace @8.8.8.8 ns1.w.example.com, then you will see where it breaks (on condition that there's only one NS for w).
    – Leo
    Commented Feb 14, 2019 at 18:42
  • @Leo, No, dig with @ and +trace at the same time does not make sense, as @ will not be taken into account since +trace forces normal resolution process starting at root nameserver. What needs to be tested first is directly at authoritative nameserver and only later at recursive ones. And please remember that there is not only 8.8.8.8 in the world, but also 1.1.1.1, 9.9.9.9, 80.80.80.80 or 64.6.64.6 among many others. Anyway it is still preferable to test local recursive ones first, specially if you can control them (bypassing any cache issues, etc.) Commented Feb 14, 2019 at 19:57

1 Answer 1

0

At the zone of domain.com you need the delegation AND a glue record. Respectively the forlast and last record here:

$ORIGIN example.com.
@      NS  auth.dns.example
@      NS  auth.dns.example
@      NS  auth.dns.example
...
w      NS  ns1.w
ns1.w  A   192.0.2.139

The glue record is "out-of-zone" data, needed to pre-indicate the address of that nameserver - as without that info a resolver can't guess it.

At the zone of w.example.com you need to have

$ORIGIN w.example.com.
@      NS  ns1
ns1    A   192.0.2.139
11
  • Why three NS records exactly the same? Commented Feb 14, 2019 at 14:49
  • The OP already said he has "A ns1.w.example.com directs to 192.0.2.139" so that is the glue, which does not explain then his problem (of course the useless obfuscation does not help) Commented Feb 14, 2019 at 14:53
  • The question was modified. So is my answer. So don't blame me for either.
    – Leo
    Commented Feb 14, 2019 at 18:33
  • The "three the same records" are to indicate the current auth.
    – Leo
    Commented Feb 14, 2019 at 18:38
  • Obfuscating is to keep it as clear as possible. The opposite is what makes is needless complex. And adding a irrelevant DNSSEC topic is even more useless.
    – Leo
    Commented Feb 14, 2019 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.