Fail op DNSsy

[Verwijderd]

Het volgende verschijnsel doet zich voor.
Wij hosten diverse website's op een cluster in Nederland, waarbij per website een eigen ip is ingesteld.
Rapporten via DNSsy geven voor twee Australische domeinen verschillende uitslagen. Eén van de twee heeft aardig wat fails erin en de andere veel minder.
Onze hostingprovider geeft aan dat dit te maken heeft met verbindingsproblemen met Australië, maar ons lijkt het meer een configuratie-probleem (lees: dns-instellingen).
Wat kan de oorzaak zijn?

[PowerSp00n]

Ik neem aan dat DNSsy een beschrijving geeft van welke tests er fout gaan? Zonder verdere informatie kunnen we hier alleen gissen naar wat het probleem is? Verbindingsproblemen geef ik een kleine kans, eigenlijk geen maargoed. Afhankelijk van wat er fout gaat dus

[Verwijderd]

'tis wel een hele lijst hoor.
Maar de output voor beide domeinen is dus ook anders.

Domein1:

Test Results Status
Checking domain format: Hostname looks good. Pass
Checking for parent nameservers: Found 9 parent nameservers. Pass
Checking for parent glue: Found glue from root nameservers to parent nameservers. Info
NS records at parent nameserver: Your NS records at your parent nameserver are:

audns.optus.net [no glue] TTL 259200
au2ld.csiro.au [130.116.2.21] TTL 259200
dns1.telstra.net [no glue] TTL 259200
ns4.ausregistry.net.au [202.65.14.140] TTL 259200
ns3.melbourneit.com [no glue] TTL 259200
ns3.ausregistry.net.au [128.242.113.189] TTL 259200
ns2.ausregistry.net.au [202.65.13.73] TTL 259200
ns1.ausregistry.net.au [202.65.12.73] TTL 259200
ns1.audns.net.au [58.65.255.73] TTL 259200
udns4.ausregistry.net.au [156.154.103.18] TTL 259200
udns3.ausregistry.net.au [156.154.102.18] TTL 259200
udns2.ausregistry.net.au [156.154.101.18] TTL 259200
udns1.ausregistry.net.au [156.154.100.18] TTL 259200

Provided by a1.audns.net.au Info
Nameservers listed at parent: Your nameservers are listed at the parent nameserver. Pass
Glue at parent nameserver: Glue is not provided from parent nameserver to your nameservers. This means they did not provide the IP address of your nameservers, so an extra step is required to resolve your domain, giving slower lookup times. This is common if your nameservers are in a different TLD than your domain name. The following nameservers did not have glue:

audns.optus.net
dns1.telstra.net
ns3.melbourneit.com
Performance
Nameserver name validity: The parent nameserver responded with NS records that appear valid. Pass
Nameserver A records: All of your nameservers have A records. Pass
Nameserver A records match parent glue: All of the glue provided by the parent nameserver matches the A records for your nameservers. Pass
NS records at your nameservers: Your NS records at your nameservers are:

audns.optus.net reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


au2ld.csiro.au reported:
ns2.nedstars.nl [no glue] TTL 14400
ns1.nedstars.nl [no glue] TTL 14400


dns1.telstra.net reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


ns4.ausregistry.net.au reported:
ns2.nedstars.nl [no glue] TTL 14400
ns1.nedstars.nl [no glue] TTL 14400


ns3.melbourneit.com reported:
ns2.nedstars.nl [no glue] TTL 14400
ns1.nedstars.nl [no glue] TTL 14400


ns3.ausregistry.net.au reported:
ns2.nedstars.nl [no glue] TTL 14400
ns1.nedstars.nl [no glue] TTL 14400


ns2.ausregistry.net.au reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


ns1.ausregistry.net.au reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


ns1.audns.net.au reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


udns4.ausregistry.net.au reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


udns3.ausregistry.net.au reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


udns2.ausregistry.net.au reported:
ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400


udns1.ausregistry.net.au reported:
ns2.nedstars.nl [no glue] TTL 14400
ns1.nedstars.nl [no glue] TTL 14400
Info
Nameservers listed at your namservers: Your nameservers are listed at your nameservers. Pass
Glue at your nameservers: Glue is not provided by your nameservers. This means they did not provide the IP address of your nameservers, so an extra step may be required to resolve your domain. The following nameservers did not have glue:

ns2.nedstars.nl
ns1.nedstars.nl


You should add A records for your nameservers into your domain zone to fix this. Performance
Nameserver A records match nameserver glue: No glue - test cannot be performed. Info
Parent glue matches your glue: The glue provided by the parent nameserver and your nameserver matches. Pass
Nameservers match (parent): Some nameservers returned by the parent nameserver are not returned by your nameservers. The following differences were found:

udns1.ausregistry.net.au
udns2.ausregistry.net.au
udns3.ausregistry.net.au
udns4.ausregistry.net.au
ns1.audns.net.au
ns1.ausregistry.net.au
ns2.ausregistry.net.au
ns3.ausregistry.net.au
ns3.melbourneit.com
ns4.ausregistry.net.au
dns1.telstra.net
au2ld.csiro.au
audns.optus.net
Fail
Nameservers match (yours): Some nameservers returned by your nameservers are not returned by the parent nameserver. The following differences were found:

ns1.nedstars.nl
ns2.nedstars.nl
Fail
All nameservers responded: All of your nameservers responded. Pass
Only root nameservers returned: Your nameservers returned at least 1 non-root nameserver referernce. Pass
Any root nameservers returned: Your nameservers did not return any root nameserver referernces. Pass
All of your nameservers match: Your nameservers returned different nameserver records.

At your nameservers I found:
ns2.nedstars.nl
ns1.nedstars.nl
At parent nameserver I found:
udns1.ausregistry.net.au
udns2.ausregistry.net.au
udns3.ausregistry.net.au
udns4.ausregistry.net.au
ns1.audns.net.au
ns1.ausregistry.net.au
ns2.ausregistry.net.au
ns3.ausregistry.net.au
ns3.melbourneit.com
ns4.ausregistry.net.au
dns1.telstra.net
au2ld.csiro.au
audns.optus.net
Fail
All of your nameservers return an A record: Some of your nameservers failed to return an A record for your domain. This is probably not what you want. The following nameservers did not return an A record:

udns1.ausregistry.net.au
udns2.ausregistry.net.au
udns3.ausregistry.net.au
udns4.ausregistry.net.au
ns1.audns.net.au
ns1.ausregistry.net.au
ns2.ausregistry.net.au
ns3.ausregistry.net.au
ns3.melbourneit.com
ns4.ausregistry.net.au
dns1.telstra.net
au2ld.csiro.au
audns.optus.net
Warning
Recursive lookups: None of your nameservers support recursive lookups. Pass
Nameservers respond authoritatively: Some of your nameservers did not respond authoritatively for your domain. The following nameservers did not respond authoritatively:

udns1.ausregistry.net.au
udns2.ausregistry.net.au
udns3.ausregistry.net.au
udns4.ausregistry.net.au
ns1.audns.net.au
ns1.ausregistry.net.au
ns2.ausregistry.net.au
ns3.ausregistry.net.au
ns3.melbourneit.com
ns4.ausregistry.net.au
dns1.telstra.net
au2ld.csiro.au
audns.optus.net
Warning
Nameserver name validity: All of your nameservers responded with NS records that appear valid. Pass
Number of nameservers: You have too many nameservers. Too many nameservers cause larger packets, requiring more bandwidth. You have 13, and should aim to reduce this to no more than 5. Performance
CNAME returned: No CNAMES found when looking up your domain at your nameservers. Pass
Nameservers on different class C: Your nameservers are of different class C IP addresses. This is an indication (but not proof) that they may not be co-located. Pass
Nameservers on private IPs: Your nameservers appear to be on public IP addresses. Pass
SOA record: None of your nameservers returned an SOA record for your domain. This is very bad. Skipping SOA tests. Fail

Domein 2:

Test Results Status
Checking domain format: Hostname looks good. Pass
Checking for parent nameservers: Found 9 parent nameservers. Pass
Checking for parent glue: Found glue from root nameservers to parent nameservers. Info
NS records at parent nameserver: Your NS records at your parent nameserver are:

ns1.nedstars.nl [no glue] TTL 14400
ns2.nedstars.nl [no glue] TTL 14400

Provided by udns1.ausregistry.net.au Info
Nameservers listed at parent: Your nameservers are listed at the parent nameserver. Pass
Glue at parent nameserver: Glue is not provided from parent nameserver to your nameservers. This means they did not provide the IP address of your nameservers, so an extra step is required to resolve your domain, giving slower lookup times. This is common if your nameservers are in a different TLD than your domain name. The following nameservers did not have glue:

ns1.nedstars.nl
ns2.nedstars.nl
Performance
Nameserver name validity: The parent nameserver responded with NS records that appear valid. Pass
Nameserver A records: All of your nameservers have A records. Pass
Nameserver A records match parent glue: No glue - test cannot be performed. Info
NS records at your nameservers: Your NS records at your nameservers are:

ns1.nedstars.nl reported:
ns2.nedstars.nl [217.195.113.10] TTL 86400
ns1.nedstars.nl [217.195.118.140] TTL 86400


ns2.nedstars.nl reported:
ns2.nedstars.nl [217.195.113.10] TTL 86400
ns1.nedstars.nl [217.195.118.140] TTL 86400
Info
Nameservers listed at your namservers: Your nameservers are listed at your nameservers. Pass
Glue at your nameservers: Glue is provided by your nameservers. This means they provided the IP address of your nameservers. Pass
Nameserver A records match nameserver glue: All of the glue provided by your nameserver matches the A records for your nameservers. Pass
Parent glue matches your glue: The glue provided by the parent nameserver and your nameserver matches. Pass
Nameservers match (parent): All nameservers returned by the parent nameserver are also returned by your nameserver. Pass
Nameservers match (yours): All nameservers returned by the your nameservers are also returned by the parent nameserver. Pass
All nameservers responded: All of your nameservers responded. Pass
Only root nameservers returned: Your nameservers returned at least 1 non-root nameserver referernce. Pass
Any root nameservers returned: Your nameservers did not return any root nameserver referernces. Pass
All of your nameservers match: All of your nameservers return the same nameserver records. Pass
All of your nameservers return an A record: All of your nameservers returned an A record for your domain. Pass
Recursive lookups: Some of your nameservers provide recursive lookups. This is bad since it could be used to poison caches or other DNS attacks. The following nameservers indicated that they support recursive lookups:

ns2.nedstars.nl
ns1.nedstars.nl
Security
Nameservers respond authoritatively: All of your nameservers responded authoritatively for your domain. Pass
Nameserver name validity: All of your nameservers responded with NS records that appear valid. Pass
Number of nameservers: You have only 2 nameservers, which is the minimum allowed. There is a chance that they could both fail simultaneously. Although not necessary, you should consider increasing the number of nameservers to 3. Warning
CNAME returned: No CNAMES found when looking up your domain at your nameservers. Pass
Nameservers on different class C: Your nameservers are of different class C IP addresses. This is an indication (but not proof) that they may not be co-located. Pass
Nameservers on private IPs: Your nameservers appear to be on public IP addresses. Pass
SOA record: Your SOA record at ns1.nedstars.nl:

Serial: 2009050800
Master Nameserver: ns1.nedstars.nl.
Hostmaster eMail: hostmaster.ppse.net.
Refresh: 14400 (4 hours)
Retry: 3600 (60 mins)
Expire: 604800 (7 days)
Minimum TTL: 86400 (24 hours)
Info
Number of SOA records: Each of your nameservers returned exactly 1 SOA record. Pass
SOA Serial Match: Each of your nameservers returned the same SOA serial number. Pass
SOA Master Nameserver Match: Each of your nameservers returned the same SOA master nameserver. Pass
SOA Admin Email Match: Each of your nameservers returned the same SOA admin email address. Pass
SOA Refresh Match: Each of your nameservers returned the same SOA refresh value. Pass
SOA Retry Match: Each of your nameservers returned the same SOA retry value. Pass
SOA Expire Match: Each of your nameservers returned the same SOA expire value. Pass
SOA Minimum TTL Match: Each of your nameservers returned the same SOA minimum TTL value. Pass
SOA Serial Number: Your SOA serial number matches the recommended format YYYYMMDDnn [RIPE-203]. Pass
SOA Master Nameserver: Your SOA master nameserver is ns1.nedstars.nl. It is also listed at the parent nameservers. This is correct. Pass
SOA Admin Email: Your SOA admin email address is [e-mail]. This seems to be a valid email address. Pass
SOA Refresh: Your SOA refresh value is 4 hours. This specifies how often a slave nameserver checks for DNS updates at the master. This seems to be OK. RFC 1912 recommends values between 20 minutes and 12 hours. Pass
SOA Retry: Your SOA retry value is 60 mins. This is the time a slave nameserver will wait if an attempt to contact a primary nameserver failed before it tries again. This seems to be OK. Pass
SOA Expire: Your SOA expire value is 7 days. This is how long a slave nameserver will cache data if it cannot reach the master nameserver. If your master nameserver is unreachable for longer than this your slave nameservers will no longer cache your DNS. This seems to be OK. Pass
SOA Minimum TTL: Your SOA minimum TTL value is 24 hours. This is interpreted by servers as the default TTL. It can be overridden on individual DNS entries. This seems high. This means that if you make DNS changes those changes may not propagate throughout the internet for a long time. Warning
MX records: I found the following MX records:

sav3.nedstars.nl 200 [208.77.101.197]
sav7.nedstars.nl 25 [217.195.118.186]
sav1.nedstars.nl 50 [217.195.118.136]
sav2.nedstars.nl 100 [195.86.39.12]

This is all of the MX servers I found. Info
All nameservers return same MX: All of your nameservers returned the same MX records. Pass
MX records have A records: All of your MX servers have A records. Pass
MX records have CNAMEs: None of your MX servers have CNAME records. This is good. Pass
MX records are IPs: None of your MX records are IP addresses. This is good. Pass
MX records are valid: All of your MX records appear to be valid hostnames. Pass
MX use public IP: All of your MX servers have public IP addresses. Pass
MX IPs have reverse DNS: All of your MX servers have reverse DNS (PTR) entries. This is good since some mail server will refuse to accept email from you. Pass
Connecting to MX 208.77.101.197: I was unable to connect to the SMTP port on 208.77.101.197. I only waited 5 seconds, so it may be that your mail server is slow, or may not be responding. Skipping further tests for 208.77.101.197 Fail
Connecting to MX 217.195.118.186: I was unable to connect to the SMTP port on 217.195.118.186. I only waited 5 seconds, so it may be that your mail server is slow, or may not be responding. Skipping further tests for 217.195.118.186 Fail
Connecting to MX 217.195.118.136: I was unable to connect to the SMTP port on 217.195.118.136. I only waited 5 seconds, so it may be that your mail server is slow, or may not be responding. Skipping further tests for 217.195.118.136 Fail
Connecting to MX 195.86.39.12: I was unable to connect to the SMTP port on 195.86.39.12. I only waited 5 seconds, so it may be that your mail server is slow, or may not be responding. Skipping further tests for 195.86.39.12 Fail
WWW record: You have a WWW record setup for your domain.

www.vietnamonline.com.au -> 217.195.119.9 Pass
WWW is public: Your WWW record is a public IP address. Pass
Connecting to WWW server: Connected to WWW port on www.vietnamonline.com.au OK. Pass
Checking HTTP version: HTTP version 1.1 supported. Pass
WWW server type: Your web server says it is:

Apache/2.2.4 (FreeBSD) mod_ssl/2.2.4 OpenSSL/0.9.7e-p1 DAV/2 PHP/5.1.6 with Suhosin-Patch Info
WWW server version: Your web server appears to reveal version information. This can pose a security risk if vulnerabilities are identified in this version. You should consider disabling version information in your server configuration. Security
WWW home page: Your web server returned the home page of your web site. Pass

[PowerSp00n]

Dit heeft niets te maken met verbindingsproblemen, het lijkt erop dat DNSsy niet echt goed om kan gaan met third-level domeinen. Ik heb er zelf ook een paar gecontroleerd waarvan de DNS wel goed is, maar DNSsy ook meerdere failed resultaten geeft. Het kan zijn dat de configuratie bij delegaties van het .au domein wat verschillen waardoor je bij de een wel fouten krijgt en bij de andere niet, maar hoe .au precies in elkaar zit kan ik je niet vertellen. Probeer eens http://www.zonecheck.fr/demo/, deze kan flink wat uitgebreide checks doen en werkt hier prima met third-level domeinen.

[Verwijderd]

Thanks voor je feedback en link.
Zonecheck geeft de volgende info, maar ziet er een stuk hoopvoller uit.

Domein1:

Progress
Progression Tests Speed Time
100% 112 1.96 0:00

can deliver email to hostmaster


Test results
---- warning ----
Nameservers are all part of the same AS
Adv: ZoneCheck

To avoid loosing all connectivity with the authoritative DNS in case of a routing problem inside your Autonomous System, it is advised to host the DNS on different AS.

All the nameservers are part of the same Autonomous System (AS number 34012), try to have some of them hosted on another AS.

generic


Reverse for the nameserver IP address doesn't match
ns1.nedstars.nl./217.195.118.140
ns2.nedstars.nl./217.195.113.10


Root-servers IP addresses are not consistent with ICANN
Ref: IETF RFC2870 (p.1)

The Internet Corporation for Assigned Names and Numbers (ICANN) has become responsible for the operation of the root servers. The ICANN has appointed a Root Server System Advisory Committee (RSSAC) to give technical and operational advice to the ICANN board. The ICANN and the RSSAC look to the IETF to provide engineering standards.

The root-server l.root-servers.net. addresses (199.7.83.42, 2001:500:3::42) are not the same as the ICANN addresses (199.7.83.42).

ns1.nedstars.nl./217.195.118.140
ns2.nedstars.nl./217.195.113.10


[TEST delegated domain is not an open relay]: Timeout
generic


Final status
SUCCESS (but 6 warning(s))

Domein 2:

Progress
Progression Tests Speed Time
100% 112 1.98 0:00

can deliver email to hostmaster


Test results
---- warning ----
Nameservers are all part of the same AS
Adv: ZoneCheck

To avoid loosing all connectivity with the authoritative DNS in case of a routing problem inside your Autonomous System, it is advised to host the DNS on different AS.

All the nameservers are part of the same Autonomous System (AS number 34012), try to have some of them hosted on another AS.

generic


Reverse for the nameserver IP address doesn't match
ns1.nedstars.nl./217.195.118.140
ns2.nedstars.nl./217.195.113.10


Root-servers IP addresses are not consistent with ICANN
Ref: IETF RFC2870 (p.1)

The Internet Corporation for Assigned Names and Numbers (ICANN) has become responsible for the operation of the root servers. The ICANN has appointed a Root Server System Advisory Committee (RSSAC) to give technical and operational advice to the ICANN board. The ICANN and the RSSAC look to the IETF to provide engineering standards.

The root-server l.root-servers.net. addresses (199.7.83.42, 2001:500:3::42) are not the same as the ICANN addresses (199.7.83.42).

ns1.nedstars.nl./217.195.118.140
ns2.nedstars.nl./217.195.113.10


[TEST delegated domain is not an open relay]: Timeout
generic


Final status
SUCCESS (but 6 warning(s))

[PowerSp00n]

In orde dus zoals je zelf kan zien. De warnings zijn een aantal punten om beter aan guidelines te voldoen e.d. Je had trouwens wel wat selectiever kunnen copy/pasten ...

[Verwijderd]

Thanks voor je feedback en....je hebt wel gelijk...