RE: [cobalt-users] I got the DNS blues

["Paul Shuttleworth" <paul@xxxxxxxxxxxxxx>]

> -----Original Message-----
> From: cobalt-users-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Andy Jacobs
> Sent: 02 April 2004 11:55
> To: cobalt-users@xxxxxxxxxxxxxxx
> Subject: [cobalt-users] I got the DNS blues
>
>
> This is driving me nuts still!
>
> I had a site on one server - www.davidjones.uk.com.  I moved it to another
> server and updated the nameservers.
>
> The domain shows that it is pointed to the right place as far as the
> nameservers are concerned:
>
> http://www.centralnic.com/doctor/?domain=davidjones.uk.com
>
> If I set the site up on 212.67.196.157 and delete it from 212.67.197.197
> then going to the website just takes me to ns.redcatmedia.net.
>
> If I set it up on 197.197 then the site works - which I would expect.
>
> The problem as I see it is that there is an A record pointing the site to
> 197 which is wrong.  This is what I have on 196.157 in the DNS bit for the
> domain:
>
> davidjones.uk.com            212.67.196.157      
>  mail.davidjones.uk.com            212.67.196.157      
>  www.davidjones.uk.com            212.67.196.157
>
> It's been 2 weeks now since the nameserver update so I'm guessing
> it isn't a
> propagation problem.
>
> Where is the A record that is pointing to 197.197?  I just don't
> get it.  Is
> there a file on the server (apart from httpd.conf) that contains these
> records?
>
> Any help would be much appreciated.
>
> Andy
>

Andy

Doing a little digging reveals another Nameserver (ns.mediamarks.net) this
seems to be authoratitive for the www.davidjones.uk.com domain.

How does this fit into things with ns.redcatmedia and ns2.redcatmedia ? they
seem to share the same IP addresses ...157 and ...158
Is it listed in the SOA for the domain.
That is the one that is giving the 197.197 address.

OK now for the long bit....

[root /root]# dig ns.mediamarks.net

; <<>> DiG 8.3 <<>> ns.mediamarks.net
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;;      ns.mediamarks.net, type = A, class = IN

;; ANSWER SECTION:
ns.mediamarks.net.      1d23h44m48s IN A  212.67.196.158

;; AUTHORITY SECTION:
mediamarks.net.         1d23h44m48s IN NS  ns.mediamarks.net.
mediamarks.net.         1d23h44m48s IN NS  ns2.mediamarks.net.

;; ADDITIONAL SECTION:
ns.mediamarks.net.      1d23h44m48s IN A  212.67.196.158
ns2.mediamarks.net.     1d23h44m48s IN A  212.67.196.157

;; Total query time: 7 msec
;; FROM: www.webzhost.co.uk to SERVER: default -- 195.74.126.58
;; WHEN: Fri Apr  2 12:58:47 2004
;; MSG SIZE  sent: 35  rcvd: 115


This is for ns.mediamarks.net and is self explanatory.

[root /root]# dig @ns.mediamarks.net www.davidjones.uk.com

; <<>> DiG 8.3 <<>> @ns.mediamarks.net www.davidjones.uk.com
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUERY SECTION:
;;      www.davidjones.uk.com, type = A, class = IN

;; ANSWER SECTION:
www.davidjones.uk.com.  1D IN A         212.67.197.197

;; AUTHORITY SECTION:
www.davidjones.uk.com.  1D IN NS        ns.mediamarks.net.

;; ADDITIONAL SECTION:
ns.mediamarks.net.      1D IN A         212.67.196.157

;; Total query time: 22 msec
;; FROM: www.webzhost.co.uk to SERVER: ns.mediamarks.net  212.67.196.158
;; WHEN: Fri Apr  2 13:00:26 2004
;; MSG SIZE  sent: 39  rcvd: 102

As you can see ns.mediamarks is returning the 197.197 form ns.mediamarks.


Only one nameserver is being returned which is also a bit fishy.

[root /root]# dig @ns.mediamarks.net davidjones.uk.com

; <<>> DiG 8.3 <<>> @ns.mediamarks.net davidjones.uk.com
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;;      davidjones.uk.com, type = A, class = IN

;; ANSWER SECTION:
davidjones.uk.com.      1D IN A         212.67.196.157

;; AUTHORITY SECTION:
davidjones.uk.com.      1D IN NS        ns2.redcatmedia.net.
davidjones.uk.com.      1D IN NS        ns.redcatmedia.net.

;; ADDITIONAL SECTION:
ns2.redcatmedia.net.    1D IN A         212.67.196.158
ns.redcatmedia.net.     1D IN A         212.67.196.157

;; Total query time: 22 msec
;; FROM: www.webzhost.co.uk to SERVER: ns.mediamarks.net  212.67.196.158
;; WHEN: Fri Apr  2 13:17:51 2004
;; MSG SIZE  sent: 35  rcvd: 133

OK so the domain davidjones.uk.com is being returned from ns/ns2.redcatmedia
and not ns/ns2.mediamarks.net.

SO ....

You seem to have an A record for davidjones.uk.com in ns/ns2.redcatmedia
returning the correct record of ...157
and an A record for www.davidjones.uk.com in ns/ns2.mediamarks.net returning
the incorrect 197.197.

The authoratitive namserver for davidjones.uk.com is ns.redcatmedia.net
The autoratitive nameserver for www.davidjones.uk.com is ns.mediamarks.net
These may be on the same machine (?) and share the same IP addresses. ...157
and ...158

I am not sure if any of this helps, but sometimes you just have to go back
and look at the obvious.
Nameservers do not make up these things therefore the records must be coming
form your nameservers.


Paul.