I have an important client, a fairly large Family History Society, that I am having some serious DNS issues with.
For several years I had been using ClouDNS as a secondary nameserver but just recently I switched to puck.nether.net and set up a custom secondary nameserver. I cancelled the account with ClouDNS and removed all their nameservers/IPs from MIAB as well as the references to allow-notify and allow-transfer from the bind config options. I replaced those references with Puck’s IP addresses (A and AAAA). Every other domain I host through MIAB except this one and one other accepted the new secondary nameserver with no problems. I have tried any number of configurations to try and create new subdomains, but they refuse to propagate.
Digger.tools shows the following for berksfhs.org, the domain with the issues:
I have DNSSEC disabled for all the domains managed by MIAB. If I can’t resolve this issue, I may need to find another DNS solution at least for that client. Is there something I am missing? Any help would be appreciated. Thank you.
Note the first line showing the nameservers. Those clouDNS nameservers are also what digger.tools and nslookup.io (citing both Cloudflare and Google) show for nameservers. THAT is what I don’t understand. I need to know why that is happening and what I can do to get MIAB to show the correct information. MIAB also intermittently show MX errors even though I have it set correctly at the registrar.
The client requires additional subdomains and the situation is becoming critical; however, when I create one is MIAB under custom DNS, it never propagates and remains unusable. This situation has been ongoing for some time and it really needs to be resolved.
I have some further information that I received from my Registrar, NetEarthOne, after I contacted them for help with this issue. The sent me a link to the following: intoDNS: berksfhs.org - check DNS server and mail server health. That link shows the following errors:
The thing is, those nameservers are NOT anywhere at the registrar either on the uniquelyyoursmail.com domain (the primary MIAB domain), OR anywhere on berksfhs.org. All is as you can see in my screenshots above.
Can anyone please help me figure out what is going on?
I see at the registrar you have configured ns1.emmons.uniquelyyoursmail.com and ns3.emmons.uniquelyyoursmail.com. I assume this is what you want, and that your DNS server at ns1.emmons.uniquelyyoursmail.comshould only usens3.emmons.uniquelyyoursmail.com` as external DNS server.
It looks like your dns server at ns1.emmons.uniquelyyoursmail.com does not properly take over the configured secondary DNS servers, even though it looks ok in the screenshot.
Can you:
Check custom.yaml for the line starting with _secondary_nameserver: (also include next lines if they are indented)
Check the dns file /etc/nsd/zones/berksfhs.org.txt
If you run sudo ./tools/dns_update --force do the contents of the /etc/ file change?
If not, check the output of sudo journalctl -u mailinabox and look for reported errors.
After going through things I discovered that nsd was restarting, but not properly restarting as there was an error in creation of the DS records for the zone.txt.signed file. This error was preventing nsd from reloading with updated zone records when there was a change, and consequently it was not publishing the updated records.
I discovered this by running service nsd status. The output showed the error in specific lines of the zone.txt.signed file.
Here is the specific output:
Feb 15 21:55:37 emmons.uniquelyyoursmail.com nsd[128569]: [2025-02-15 21:55:37.182] nsd[128569]: error: berksfhs.org.txt.signed:343: CNAME and other data at the same name
The error output suggested that there was both an A record and a CNAME record present. I then discovered that this was indeed the case. One of the subdomains in use had both records.
Once the duplicate records were resolved, the zone file properly updated, and viola.
