Gandi, glue records, digital ocean

Hi, I recentlty installed MIAB latest version on Ubuntu 14.04.5 LTS (latest U14 on DO).
I’ve set up glue records +NS on gandi.

I’m still having (after 5-6 days) :

Nameserver glue records are incorrect. The and nameservers must be configured at your domain name registrar as having the IP address They currently report addresses of [Not Set]/[Not Set]. It may take several hours for public DNS to update after a change.

This domain must resolve to your box’s IP address ( in public DNS but it currently resolves to [Not Set]. It may take several hours for public DNS to update after a change. This problem may result from other issues listed above.

DNSSEC in unavailable at gandi for .gg
on the box:
root@box:~# host
Host not found: 2(SERVFAIL)
root@box:~# host -t ns
Host not found: 2(SERVFAIL)
Installation went fine. Re-try doing mailinabox at prompt => same no problems at install, but DNS not properly set.
Already read the similar topics here.

I’m stuck. What can I do?
Thanks in advance,



The first step would be to double check that your GLUE records are properly set at Gandi.

Hi alento,

Thanks for you answer.
I already double (triple) checked.
It seems to me to be good:

Name servers as well:

Am I wrong?

Best regards, Hubert

No, it certainly does not look like you are wrong. Sadly, I am weak in the subject of DNS but what I can see is that it looks like your glue records are not being properly identified to the root servers. I can only suggest to reach out to Gandi.

Should look something like this:

However, it appears that is not resolving for tld gg perhaps?

I can see the (big) difference between the two results…
Unfortunately, I’m the weakest as far as DNS are concerned.

I’m gonna post a message to gandi support, and I’ll keep you and this thread informed.

As of today, Gandi is contacting the .gg registry.

I hope that they work with some urgency to resolve this for you. For now, it is just a waiting game unfortunately. :frowning:

Thanks for the update.

OMG. Basically, they’re saying it’s not gonna work.

This configuration is never going to work for at least two reasons.
Firstly, you must always have two nameservers.
Simply creating a second host name pointing to the same server will not provide the redundancy that the requirement for a minimum of two nameservers in RFC 1034 is designed to provide. It is a Really Bad Idea.

But more importantly, these hostnames are not in the domain anway!

On closer inspection I see they are apparently inside the domain. This is not the same thing.

The domain, however, relies upon the domain. And that cannot work as that is relian t on the domain working first.

If the domain it used the same nameservers (e.g. it would need glue records that belong in it parent domain (i.e. whic is the zone, not the gg zone).

But that’s not working yet . .

Put simply, however, the nameserver records you are attempting to create not in-bailiwick thus will not be generated in the TLD zone.

On using DIG, I see this nameserver is authoritative for the zone.

But it is not authoritative for the zone and there are no NS records for that domain there. therefore only exists as a hostname inside, not as a subdomain.

If you need the registry to create glue for any hostname, it has to be in bailiwick (e.g.

I trust this helps rather than confuses?

To resolve the problem, we recommend you to delete the current glue records and and to create direct glues (for example and pointing to different IP addresses.

You can then configure your domain name with the new glue records.

As far as I understand.
Point 1 : it’s a requirement to have two distinct NS. I can deal with it one way or another.
Point 2 : the way MIAB require the NS to be named (ns[12].box.domain.tld) is never going to work.

a. why is it working (does it really -like 100% RFC compliant-) with other tld? Who’s right/wrong?
b. is there a documented way to make MIAB work with external DNS? for example copy/paste required configuration in provider’s DNS. I think I’ve read in the setup guide that it will not 100% work…
c. is there a “3rd way”: like creating ns[12] (not .box. like they recommend) and then configure something into MIAB to make it work?

Of course, not being a DNS expert, these questions may not be crystal clear…

Thanks in advance for your help, Hubert

Sigh … I am not certain that they have a clue what they just said even … who provided that reply? Gandi? or Island Networks? I do not see that they even addressed the issue of the root-server,net not returning the IP address of the glue record … which is the whole point of glue records. I cannot remember exactly what the gwhois dot org page looked like originally, but does it seem as though it has changed to you?

Point 1 - true but mostly unenforced.
Point 2 - not true - it works on most every other tld.

a - see point 1
b - yes, look at your system/external DNS page within your MiaB admin area … it is all covered there.
c - probably, but overcomplicating a normally simple issue.

Just a reminder, as I am not a DNS expert I could quite easily be missing something. I want to tear the response that you received to shreds, based on seeing it work repeatedly, but I am not competent enough with DNS to be articulate enough on the subject to do that properly.

@murgero - any thoughts?

Thanks for your help.

The answer is provided by the .gg registry. Gandi forwarded it to me without further explanations.
I think I’ll go with option b, unless @murgero tells me otherwise.

It’s weird though that it works usually, I’m going to ask gandi about it.

I’ll keep you informed, Hubert


Totally shifting gears here … if there is some obscure reason(s) that the gg ccTLD is not working out you can always register a .net or .com domain name and use it as the domain for the mail service.

Yes, emails addresses such as hubert@gayet,gg would be fully supported on your install of MiaB without any jumping through hoops! (By following the procedure for multiple domains)

I wonder if Island Networks (the tld registry for .gg and .je) require 2 separate nameservers such as .ca, .nl, and others do. Their response does not make it clear if that is a requirement …

or an opinion.

Nice idea the multiple domain thing!

Meanwhile, I’ve tried to put everything without .box. and it seems to be working…
(i.e. glue records and ns ns[12]

Surprisingly admin panel is happy:

Nameserver glue records are correct at registrar. [ns1/ ↦]

Nameservers are set correctly at registrar. [;] also tells me that my dns are ns[12] notice the .box. unhappy:
Failed to resolve the following nameservers: ,

I’m a bit confused but it seems to work…
Is it really a viable solution?

Does not seem to be a requirement otherwise even witout .box. it wouldn’t work…

It probably needs time to propagate …

I believe that it will work insomuch as if you listed as the nameserver since the DNS inquiries are being sent to the IP address - the incoming name server likely would not care who they are addressed to ( or or just that they are arriving at the correct address of the authoritative name server for the (sub)domain being looked up (

DNSSEC may blow what I just said out of the water though … I do not know. But since Gandi does not support DNSSEC for .gg domains, it is a moot point - today anyways.

  1. For MIAB Nameservers MUST be &
  2. Nameservers look GOOD for me, albeit not fully propagated (takes 48 hours!)


Heh, perhaps ya missed the part where the nameservers were changed with Gandi to ns1 and ns2 NOT and
So, is the boxes internal DNS settings sending the response that and are the namesevers? For it certainly should not be Gandi. reports this…


Domain Status:
Transfer Prohibited by Registrar

(not available)

Gandi SAS (

Relevant dates:
Registered on 01st March 2018
Registry fee due on 01st March each year

Registration status:
Registered until cancelled

Name servers:

WHOIS lookup made on Fri, 17 Aug 2018 at 23:27:28 UTC

My first sentence states the issue :wink:

MUST be ns[1|2]

Yes, but that is NOT how they are set — but they are reporting as being set that way.

How can that be remotely possible??? isn’t full propagated. :wink: OP needs to switch back to (same with ns2)

Remember: DNS can take up to 48 hours to fully propagate. There are 13 root DNS servers, plus tens of thousands of other DNS servers that these need to propagate to.