DNS Propagation Issues (Solved)

Avatar
  • Answered
First off, this isn't an issue, I'm posting this for future people's sake. It's more of an education post.

I recently move my hosting over from GoDaddy to InMotion. When I did this, I changed my nameservers to point to InMotions. However, there were issues with my websites DNS propagation (checked using www.whatsmydns.net) that weren't being resolved. I had support look into it and they re-pushed my DNS updates out, but there were still errors in the propagation. It was strange because most people that tried to access the website were unable to, while I could. I eventually narrowed it down to OpenDNS being able to resolve the name correctly, but most other DNS systems (Comcast and Google DNS were the ones I checked) wouldn't resolve the name. I waited for a while but the errors still weren't resolved. This struck me as odd because I couldn't believe that these DNSs wouldn't refresh their cache more often, as they are some major DNS systems. I eventually started to do some advanced diagnostics on the domain and it turned out that all of the DNS systems were properly resolving the address, but there were errors with DNSSEC that I had enabled on GoDaddy. Since InMotion doesn't yet support DNSSEC (there is a cPanel update coming soon that will add in this ability) there was a break in the security chain. DNS systems that supported DNSSEC (Google DNS and Comcast DNS both support DNSSEC, while OpenDNS does not) refused to resolve the website because of these DNSSEC errors, while OpenDNS would load the website without any problems. Once I removed the remaining DNSSEC entries from my domain manager on GoDaddy, all of the DNS systems would resolve my site. Also, what looked like a propagation error (using www.whatsmydns.net) was solved as the DNS systems that supposedly couldn't resolve really just wouldn't resolve.

I mentioned this to a couple of support people that I talked to, and none of them thought this could be an issue. I thought this could be a good thing to educate them about, as it's an obscure error that probably doesn't happen often, but it's hard to diagnose as it looks like a standard DNS propagation error. I used http://dnsviz.net/d to check the DNSSEC records, and that's what showed me the problem. I also used Google DNS's query tool to get there (dns.google.com).

I'd be happy to provide more information if it can help anyone out.
tl;dr: If you have enabled DNSSEC and there appear to be propagation issues (If you've waited for a reasonable amount of time) and InMotion has already re-pushed the DNS changed, the problem is most likely a DNSSEC error.
Avatar
johnpaulb-imhs1
Hello,

Thank you for contacting us and sharing your helpful information. This should help other users who are migrating from outside web hosts.

Thank you,
John-Paul