WEEK FROM HELL - continues? must I hang myself??

Discussion in 'ISPConfig 3 Priority Support' started by craig baker, Sep 22, 2020.

  1. craig baker

    craig baker Member HowtoForge Supporter

    I have just discovered something else REALLY odd - some servers are not resolving my sites correctly! but others are!!

    my pri entries:
    [[email protected] named]# cat pri.theeldestgeek.com
    $TTL 3600
    @ IN SOA ns9.cdbsystems.com. cdb.craigscomputers.net. (
    2020082201 ; serial, todays date + todays serial #
    7200 ; refresh, seconds
    540 ; retry, seconds
    2419200 ; expire, seconds
    86400 ) ; minimum, seconds
    ;

    lists 86400 A 74.96.241.34
    mail 3600 A 74.96.241.34
    nextcloud 3600 A 74.96.241.34
    owncloud 86400 A 74.96.241.34
    theeldestgeek.com. 3600 A 74.96.241.34
    www 3600 A 74.96.241.34
    theeldestgeek.com. 3600 CAA 0 issue "letsencrypt.org"
    theeldestgeek.com. 3600 MX 10 mail.theeldestgeek.com.
    theeldestgeek.com. 3600 NS ns9.cdbsystems.com.
    theeldestgeek.com. 3600 NS ns4.cdbsystems.com.
    default._domainkey.theeldestgeek.com. 3600 TXT "v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz1YEWi39PVeCATEtAiIcCOPSXF3Sb3YqDfOxtd2362OsqoUlrTeSCxCQRmHj6A7qTYemVE4hMAU1ZdYmSriaoazuHUg2XWrFut/GbgASqL6JxVpIwVAkY1nhKE0tm+lfSKjUk5Qv+XZlET0QlblybpRy0g8jFr9QoMeW5q72ZOQIDAQAB"
    default._domainkey.theeldestgeek.com. 3600 TXT "v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz1YEWi39PVeCATEtAiIcCOPSXF3Sb3YqDfOxtd2362OsqoUlrTeSCxCQRmHj6A7qTYemVE4hMAU1ZdYmSriaoazuHUg2XWrFut/GbgASqL6JxVpIwVAkY1nhKE0tm+lfSKjUk5Qv+XZlET0QlblybpRy0g8jFr9QoMeW5q72ZOQIDAQAB"
    theeldestgeek.com. 86400 TXT "v=spf1 ip4:74.96.241.34/32 a mx a:mail.theeldestgeek.com mx:cdbsystems.com ~all"

    all looks right. and from most servers I resolve correctly.
    but on one server (also running ISPCONFIG, and I set it up) - I resolve wrong!

    <on other server>
    [email protected] cdb]# nslookup theeldestgeek.com
    Server: 75.75.75.75
    Address: 75.75.75.75#53 (<- standard coomcast dns. same if I use 8.8.8.8!)

    Non-authoritative answer:
    Name: theeldestgeek.com
    Address: 74.121.125.9 <- NOT ME!!!!!!
    Name: theeldestgeek.com
    Address: 74.121.125.8
    Name: theeldestgeek.com
    Address: 2620:104:a00b::9
    Name: theeldestgeek.com
    Address: 2620:104:a00b::8

    dig theeldestgeek.com txt

    ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> theeldestgeek.com txt
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48108
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;theeldestgeek.com. IN TXT

    ;; AUTHORITY SECTION:
    nominum.cloud. 600 IN SOA ns4.nominum.net. hostmaster.nominum.com. 2020042970 1200 600 604800 900

    ;; Query time: 28 msec
    ;; SERVER: 75.75.75.75#53(75.75.75.75)
    ;; WHEN: Sun Sep 20 18:59:36 EDT 2020
    ;; MSG SIZE rcvd: 118

    Now I have NO idea who nominum.cloud is!!!

    on another server:
    [[email protected] cdb]# dig theeldestgeek.com

    ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.3 <<>> theeldestgeek.com
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25070
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 512
    ;; QUESTION SECTION:
    ;theeldestgeek.com. IN A

    ;; ANSWER SECTION:
    theeldestgeek.com. 3384 IN A 74.96.241.34

    ;; Query time: 11 msec
    ;; SERVER: 8.8.8.8#53(8.8.8.8)
    ;; WHEN: Sun Sep 20 19:10:14 EDT 2020
    ;; MSG SIZE rcvd: 62

    [[email protected] cdb]#
    and everything here is correct! 74.96.241.34 is me. NO idea who 74.121.125.9 is??

    anyway I'm just totally exhausted !
    my brain hurts!!
    any ideas???
    thanks
     
  2. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Please put the outputs of the commands between [ code ] and [ /code ] (without the spaces) so it is readable for us.
     
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    Check your DNS record with e.g. intodns.com to see if they report any problems. Then check the data at your dns registry to ensure that the correct nameservers are configured there for your domain.
     
  4. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    I often use zonemaster.net and intodns.com.
    When running theeldestgeek.com through those, I get quite some errors. So you should resolve those - it may be why one of your servers is not resolving correctly.

    Also, the PTR for your MX record seems to be for a nameserver. That's fine, but postfix should use that hostname for sending to prevent your email from being blocked as spam.
     
  5. craig baker

    craig baker Member HowtoForge Supporter

    I've checked intodns and nothing seems unusual. I fixed a backup dns server whos address had changed. but I'm still misresolving a name on the 98.xxx server.
    intodns results for theeldestgeek.com and craigscomputers.net (hosted on same server) seem virtually the same!
    what on earth can the problem BE? who can have the wrong ip???
     
  6. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Test with zonemaster.net.

    Have you checked the hosts file on the servers?
     
  7. craig baker

    craig baker Member HowtoForge Supporter

    hes thom: ns1 is the 98.. server.
    [[email protected] etc]# cat hosts
    127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
    ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
     
  8. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    If it's a ISPConfig server, your hosts file is incorrect. See the Perfect Server tutorial.

    Have you tested with zonemaster.net?

    Can you run
    Code:
    dig theeldestgeek.com ns
    on the server that resolves incorrectly?
     
  9. craig baker

    craig baker Member HowtoForge Supporter

    zonemaster does not report any errors and certainly nothing about the 'wrong' ip address
    [[email protected] etc]# ping www.theeldestgeek.com
    PING www.theeldestgeek.com (74.121.125.9) 56(84) bytes of data.
    64 bytes from 74.121.125.9 (74.121.125.9): icmp_seq=1 ttl=52 time=17.7 ms
    64 bytes from 74.121.125.9 (74.121.125.9): icmp_seq=2 ttl=52 time=14.3 ms
    c64 bytes from 74.121.125.9 (74.121.125.9): icmp_seq=3 ttl=52 time=13.0 ms
    64 bytes from 74.121.125.9 (74.121.125.9): icmp_seq=4 ttl=52 time=11.6 ms
    no idea where 74.121.125.9 comes from.
     
  10. craig baker

    craig baker Member HowtoForge Supporter

    [[email protected] etc]# dig theeldestgeek.com ns

    ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> theeldestgeek.com ns
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36054
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;theeldestgeek.com. IN NS

    ;; AUTHORITY SECTION:
    nominum.cloud. 600 IN SOA ns4.nominum.net. hostmaster.nominum.com. 2020042975 1200 600 604800 900

    ;; Query time: 95 msec
    ;; SERVER: 75.75.75.75#53(75.75.75.75)
    ;; WHEN: Sat Sep 26 09:25:44 EDT 2020
    ;; MSG SIZE rcvd: 118
     
  11. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Then you are querying a whole different domain as theeldestgeek.com has a bunch of errors.

    This is a whole different nameserver than I get when running this, so maybe it's your DNS cache. Try emptying that.
     
  12. craig baker

    craig baker Member HowtoForge Supporter

    cat resolv.conf
    # Generated by NetworkManager
    search qhscares.com
    nameserver 75.75.75.75
    nameserver 75.75.75.76
    [[email protected] etc]#

    and rndc flush rndc reload changed nothing.
     
  13. craig baker

    craig baker Member HowtoForge Supporter

    zonemaster gives theeldestgeek.com 5 warnings no errors. 4 are dnssec and one has to do with secondary dns server
     
  14. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    But it means there is something wrong so you should look into that.

    So, to be clear, only one server has this issue? Where is it hosted?
     
  15. craig baker

    craig baker Member HowtoForge Supporter

    at a customers. runing centos setup as per perfect server.
    dig results:
    [[email protected] log]# dig theeldestgeek.com ns

    ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> theeldestgeek.com ns
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20356
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;theeldestgeek.com. IN NS

    ;; AUTHORITY SECTION:
    nominum.cloud. 520 IN SOA ns4.nominum.net. hostmaster.nominum.com. 2020042975 1200 600 604800 900

    ;; Query time: 951 msec
    ;; SERVER: 75.75.75.75#53(75.75.75.75)
    ;; WHEN: Mon Sep 28 09:48:17 EDT 2020
    ;; MSG SIZE rcvd: 118

    [[email protected] log]#

    when I do:
    [[email protected] etc]# dig @8.8.8.8 theeldestgeek.com

    ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> @8.8.8.8 theeldestgeek.com
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31518
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;theeldestgeek.com. IN A

    ;; ANSWER SECTION:
    theeldestgeek.com. 450 IN A 74.121.125.9
    theeldestgeek.com. 450 IN A 74.121.125.8

    ;; Query time: 3185 msec
    ;; SERVER: 8.8.8.8#53(8.8.8.8)
    ;; WHEN: Mon Sep 28 09:56:43 EDT 2020
    ;; MSG SIZE rcvd: 78

    I still get the wrong info using googles dns. this is from the 'affected' server.
    75.75.75.75 is the preferred local comcast static ip dns for this area.
    what on EARTH is going on??
    I have no idea where on earth 74.121.125.9 comes from.
     
  16. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

  17. craig baker

    craig baker Member HowtoForge Supporter

    I understand that and all of the various tests and check resolve it correctly.
    but my server at ns1.qhscares.com does NOT resolve it correctly. its an ispconfig/centos 7 server.
    I have looked everywhere I can think of but I cannot see HOW it could be overriding the dns with a bogus value?
    if the cox server 75.75.75.75 were poisoned had wrong entry, 8.8.8.8 should resolve correctly!
    but it does not. I'm at a loss even WHERE to look. theeldestgeek.com is NOT a domain in DNS under ispconfig on this server.
    nothing in any config file that I can see has 'nomium' whoever those are.
    now I DO see that the nomium are all ipv6 and wonder if ipv6 may be at the root of the problem??
     
  18. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

  19. craig baker

    craig baker Member HowtoForge Supporter

    nope, server was installed by me and cox is the internet provider. have NO idea who nomium.net is. odd they use ISPCONFIG :)
     

Share This Page