WA announcing DNS for a domain it doesn't own...

[shadow_man]

I have a domain thats hosted at domains.co.za

For this domain I host my OWN nameservers (ns1.yoonix.co.za and ns2.yoonix.co.za)

I'm noticing that sometimes (when querying DNS servers I don't own / run, as well as my own) that I can see Web Africa announcing DNS for my domain.

This is causing issues at times - as records don't get served correctly, as they don't exist on the WA system. Nor should they.

Examples below show domaincheap / WA NS record being served for my domain. I can also see that the SOA claims to sit with them, this obviously shouldn't be the case...

Additionally, both examples below are from querying 3rd party DNS servers. Servers which have nothing to do with me - so its not just my DNS servers that are seeing this behaviour.

Any idea how I can stop them serving these?

dig @41.74.178.33 ns yoonix.co.za

; <<>> DiG 9.8.3-P1 <<>> @41.74.178.33 ns yoonix.co.za
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45869
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;yoonix.co.za.			IN	NS

;; ANSWER SECTION:
yoonix.co.za.		84547	IN	NS	ns1.yoonix.co.za.
yoonix.co.za.		84547	IN	NS	ns1.domaincheap.co.za.
yoonix.co.za.		84547	IN	NS	ns2.yoonix.co.za.
yoonix.co.za.		84547	IN	NS	ns2.domaincheap.co.za.

;; Query time: 5 msec
;; SERVER: 41.74.178.33#53(41.74.178.33)
;; WHEN: Fri Nov 25 15:21:09 2016
;; MSG SIZE  rcvd: 114

dig @197.96.173.70 ns yoonix.co.za

; <<>> DiG 9.8.3-P1 <<>> @197.96.173.70 ns yoonix.co.za
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 665
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;yoonix.co.za.			IN	NS

;; ANSWER SECTION:
yoonix.co.za.		86400	IN	NS	cdns2.cpt.wa.co.za.
yoonix.co.za.		86400	IN	NS	cdns1.cpt.wa.co.za.

;; ADDITIONAL SECTION:
cdns2.cpt.wa.co.za.	1631	IN	A	41.185.8.22
cdns1.cpt.wa.co.za.	1617	IN	A	41.185.8.21

;; Query time: 100 msec
;; SERVER: 197.96.173.70#53(197.96.173.70)
;; WHEN: Fri Nov 25 15:27:52 2016
;; MSG SIZE  rcvd: 109

 

[netcruiser]

You have 4 NS servers configured:

http://co.za/cgi-bin/whois.sh?Domain=yoonix.co.za&Enter=Enter

 

[OCP]

If their servers are not authoritative for your domain - contact them and tell them to remove it!
(or at the very least get them to point to the correct IP addresses

 

[drs]

The problem is that you've listed Domaincheap's (= WebAfrica) nameservers as authoritative for your domain.

$ whois -h whois.registry.net.za yoonix.co.za | grep Name.Server
Name Server: ns1.domaincheap.co.za
Name Server: ns2.domaincheap.co.za
Name Server: ns2.yoonix.co.za
Name Server: ns1.yoonix.co.za
$ host ns1.domaincheap.co.za
ns1.domaincheap.co.za has address 41.185.8.21
$ host cdns1.cpt.wa.co.za.
cdns1.cpt.wa.co.za has address 41.185.8.21

The solution is to login to your registrar and list only your own nameservers as authoritative.

Once you've done that, it won't matter what answers WebAfrica's nameservers give, because nothing will refer to them for your domain. You could contact them and get them to remove the domain from their nameservers, but they'll probably figure that out when they realise you aren't paying them to host the domain.

 

[Sinbad]

The problem is that you've listed Domaincheap's (= WebAfrica) nameservers as authoritative for your domain.

$ whois -h whois.registry.net.za yoonix.co.za | grep Name.Server
Name Server: ns1.domaincheap.co.za
Name Server: ns2.domaincheap.co.za
Name Server: ns2.yoonix.co.za
Name Server: ns1.yoonix.co.za
$ host ns1.domaincheap.co.za
ns1.domaincheap.co.za has address 41.185.8.21
$ host cdns1.cpt.wa.co.za.
cdns1.cpt.wa.co.za has address 41.185.8.21

The solution is to login to your registrar and list only your own nameservers as authoritative.

Once you've done that, it won't matter what answers WebAfrica's nameservers give, because nothing will refer to them for your domain. You could contact them and get them to remove the domain from their nameservers, but they'll probably figure that out when they realise you aren't paying them to host the domain.

This is 100% accurate.

 

[shadow_man]

The problem is that you've listed Domaincheap's (= WebAfrica) nameservers as authoritative for your domain.

$ whois -h whois.registry.net.za yoonix.co.za | grep Name.Server
Name Server: ns1.domaincheap.co.za
Name Server: ns2.domaincheap.co.za
Name Server: ns2.yoonix.co.za
Name Server: ns1.yoonix.co.za
$ host ns1.domaincheap.co.za
ns1.domaincheap.co.za has address 41.185.8.21
$ host cdns1.cpt.wa.co.za.
cdns1.cpt.wa.co.za has address 41.185.8.21

The solution is to login to your registrar and list only your own nameservers as authoritative.

Once you've done that, it won't matter what answers WebAfrica's nameservers give, because nothing will refer to them for your domain. You could contact them and get them to remove the domain from their nameservers, but they'll probably figure that out when they realise you aren't paying them to host the domain.

I haven't listed them as authorative, but somehow they've popped up and decided to be...

I've checked the domains.co.za panel and I can't remove them - so i'm suspecting a bug. Going to log a ticket and ask for a manual fix.

 

[envo]

If you've ever hosted with/registered with Web Africa (or domaincheap) and transferred your domain to someone else's registrar, the registrar will keep the NS names when transferring, albeit in secondary capacity to ensure your domain keeps resolving while the registrar details are being updated (which takes a week I think?)

So always keep that in mind and check your NS records. It's weird that you can't edit your own NS records, it's as simple as just deleting the entries (usually a text field) and saving.

 

[Jade @ Absolute Hosting]

If you've ever hosted with/registered with Web Africa (or domaincheap) and transferred your domain to someone else's registrar, the registrar will keep the NS names when transferring, albeit in secondary capacity to ensure your domain keeps resolving while the registrar details are being updated (which takes a week I think?)

So always keep that in mind and check your NS records. It's weird that you can't edit your own NS records, it's as simple as just deleting the entries (usually a text field) and saving.

Agreed, simple solution is to mail web africa and advise that their name servers are not authoritative for your domain and to have them remove it from their name servers.


This is a common issue when transferring domains from quite a few Web Hosts, yet its a simple fix

 

[shadow_man]

If you've ever hosted with/registered with Web Africa (or domaincheap) and transferred your domain to someone else's registrar, the registrar will keep the NS names when transferring, albeit in secondary capacity to ensure your domain keeps resolving while the registrar details are being updated (which takes a week I think?)

So always keep that in mind and check your NS records. It's weird that you can't edit your own NS records, it's as simple as just deleting the entries (usually a text field) and saving.

I suspect its a glue issue of some sort as I keep being told "doesn't exist" when editing the NS records. Either that or a bug, but the NS records have PTR set and were operating fine until recently. I've logged a ticket, so we'll see.

 

[shadow_man]

Agreed, simple solution is to mail web africa and advise that their name servers are not authoritative for your domain and to have them remove it from their name servers.


This is a common issue when transferring domains from quite a few Web Hosts, yet its a simple fix

Yep - domain was with WA (well domaincheap) ages back and I suspect somewhere its creeped back in to the fold. Annoying.

 

[Sinbad]

A dns can't advertise itself. Your registrar must fix your ns entries in your domain.

 

[Thor]

Ahhhhhh so your the new yoonix.co.za owner - that domain was with gandi and then WA last I check so I guess you moved it to domains recently.

 

[Jade @ Absolute Hosting]

Yep - domain was with WA (well domaincheap) ages back and I suspect somewhere its creeped back in to the fold. Annoying.

There we go, hence WA assuming that they are authoritative

A dns can't advertise itself. Your registrar must fix your ns entries in your domain.

Incorrect, if an ISP has a domain configured as authoritative on their name servers then glue records with the registrar wont resolve the issue as any connections that originate from the said ISP who has not removed the old / stagnant records will resolve to what they have configured on their end, and not to what is actually published on the authoritative name servers registered with the registry.

 

[Jade @ Absolute Hosting]

You have 4 NS servers configured:

http://co.za/cgi-bin/whois.sh?Domain=yoonix.co.za&Enter=Enter

ps, update your whois shortcut

https://www.registry.net.za/whois/print.php?Domain=yoonix

I have a domain thats hosted at domains.co.za

For this domain I host my OWN nameservers (ns1.yoonix.co.za and ns2.yoonix.co.za)

According to ZACR's whois your domain is using diamatrix's name servers and not your own

Name Server: ns1.tld-ns.com
Name Server: ns2.tld-ns.net
Name Server: ns3.tld-ns.com
Name Server: ns4.tld-ns.net

You would need to register your own name servers with the registry and then perform a name server update in order to have your domain use custom / vanity servers.

PS, I see that your additional contact types are not populated as per ZACR requirements - you may want to raise this with your Registrar

 

[shadow_man]

ps, update your whois shortcut

https://www.registry.net.za/whois/print.php?Domain=yoonix


According to ZACR's whois your domain is using diamatrix's name servers and not your own

Name Server: ns1.tld-ns.com
Name Server: ns2.tld-ns.net
Name Server: ns3.tld-ns.com
Name Server: ns4.tld-ns.net

You would need to register your own name servers with the registry and then perform a name server update in order to have your domain use custom / vanity servers.

PS, I see that your additional contact types are not populated as per ZACR requirements - you may want to raise this with your Registrar

The change to domains.co.za NS servers are due to the fact that I reset the domain to their DNS. I did this in order to change to my DNS servers (which were perviously in use), but it won't let me save as it claims they don't exist - despite valid PTR records...

 

[Jade @ Absolute Hosting]

The change to domains.co.za NS servers are due to the fact that I reset the domain to their DNS. I did this in order to change to my DNS servers (which were perviously in use), but it won't let me save as it claims they don't exist - despite valid PTR records...

That makes sense, as you stated previously, I suspect this is a bug on your Registrar's interface and they'll need to resolve it for you.

 

[Murmaider]

The change to domains.co.za NS servers are due to the fact that I reset the domain to their DNS. I did this in order to change to my DNS servers (which were perviously in use), but it won't let me save as it claims they don't exist - despite valid PTR records...

Hi,

I dropped you a PM.

It's not possible to set nameservers the normal way on a domain when the nameservers reside within the same domain name.

For example, yoonix.co.za using ns1.yoonix.co.za & ns2.yoonix.co.za

In this situation the nameservers have to be setup as GLUE records (Or host records if it was an international domain).
This involves sending the IP address of the nameservers along to the registry so they can add it to the zone file.
Without this, the nameservers would never resolve as DNS resolvers would try look up nameservers on the same domain it's trying to resolve and end up in a loop.

Regards,
Dave @ Domains.co.za

 

[Sinbad]

There we go, hence WA assuming that they are authoritative

Incorrect, if an ISP has a domain configured as authoritative on their name servers then glue records with the registrar wont resolve the issue as any connections that originate from the said ISP who has not removed the old / stagnant records will resolve to what they have configured on their end, and not to what is actually published on the authoritative name servers registered with the registry.

That's not advertising
That's the isp just responding to requests from their own clients. They won't "poison" other forwarding servers unless the other server uses them as a forwarder

 

[Jade @ Absolute Hosting]

That's not advertising
That's the isp just responding to requests from their own clients. They won't "poison" other forwarding servers unless the other server uses them as a forwarder

100% it's not poisoning.
A lot of hosts including Mweb and WA use their own name servers for DNS lookups, and in the event that the domain doesn't exist on their network (name servers) then their DNS servers will allow recursion and fetch the correct records from the authoritative name servers, but as per this case with WA and many others such as mweb, the domains zone files are not removed from the hosts name servers when the domain is transferred away which results in the symptoms explained here

 

[Murmaider]

100% it's not poisoning.
A lot of hosts including Mweb and WA use their own name servers for DNS lookups, and in the event that the domain doesn't exist on their network (name servers) then their DNS servers will allow recursion and fetch the correct records from the authoritative name servers, but s per this case with WA and many others such as mweb, the domains zone files are not removed from the hosts name servers when the domain is transferred away which results in the symptoms explained here

Yeah we have come across this a lot with customers who move from Mweb to us but continue to keep their connectivity with MWEB.
Never come across with this Web Africa though.