DNS fails with NXDomain, yet it works when I query the SOA NS directly

by dgrandes   Last Updated October 19, 2019 15:00 PM - source

When I query the domain with dig, I get an NXDOMAIN error:

dig fsmax.colmeia.mimic.com.br
...
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 25993
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;fsmax.colmeia.mimic.com.br.    IN  A

;; AUTHORITY SECTION:
colmeia.mimic.com.br.   3600    IN  SOA ns-1796.awsdns-32.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

Notice that it finishes the answer with the SOA NS: ns-1796.awsdns-32.co.uk.

What baffles me, is that if I ask that NS directly, I actually get the correct answer (the Load Balancer IPs):

dig  @ns-1796.awsdns-32.co.uk fsmax.colmeia.mimic.com.br
...
;; ANSWER SECTION:
fsmax.colmeia.mimic.com.br. 60  IN  A   3.132.86.69
fsmax.colmeia.mimic.com.br. 60  IN  A   18.218.17.246

;; AUTHORITY SECTION:
colmeia.mimic.com.br.   300 IN  NS  ns-1041.awsdns-02.org.
colmeia.mimic.com.br.   300 IN  NS  ns-1796.awsdns-32.co.uk.
colmeia.mimic.com.br.   300 IN  NS  ns-53.awsdns-06.com.
colmeia.mimic.com.br.   300 IN  NS  ns-747.awsdns-29.net.

Something weird is that this was working, and then suddenly after an hour perhaps, it stopped working. I checked if I received an email from domainnameverification, but I haven't.

I have the following Route53 Config: Route53 config for colmeia.mimic.com.br

And I added the relevant entries in my local DNS Provider (Locaweb) so that I forward the DNS resolution of the subdomain (colmeia.mimic.com.br) to AWS Route 53.

Locaweb DNS Forward to AWS Route 53 Locaweb DNS SOA Forward to AWS Route 53

Lastly, I checked the DNS Propagation (https://www.whatsmydns.net/#A/fsmax.colmeia.mimic.com.br), and found that the only server that answers correctly is one in Canada.

Any help is greatly appreciated.



Related Questions


How can you Reduce Downtime with a Name Server Change?

Updated October 02, 2019 17:00 PM


nslookup not working on route-53 public hosted zone

Updated August 26, 2017 15:00 PM

Using an Elastic Load Balancer without Route53

Updated May 16, 2019 16:00 PM