DNS Not Resolving After Transfer – Affects Some Domains Only

Server

Hi everyone,

I’m facing an ongoing DNS issue with some of the domains I transferred to Cosmotown last year, and I’m hoping to get some help or insight from the community.

After the transfer, a few of these domains stopped resolving properly. I first pointed the nameservers to Cloudflare, but Cloudflare couldn’t detect that the domains were using their nameservers. To troubleshoot further, I also tried pointing the domains directly to my own server’s nameservers (which are resolving properly for other domains), but the issue persists.

I also checked using DNSChecker, and the A records for the affected domains are not resolving in most regions around the world. All DNS settings appear to be correct on both Cosmotown’s side and my server. I’m starting to wonder if this could be a registrar-side issue—possibly glue records not updating, or something else preventing proper propagation.

Has anyone experienced anything similar with Cosmotown or have ideas on what might be going wrong?

Any help would be much appreciated!

MetroVPS_NMP

Does Nameserver respond ? Can you inbox one domain name to understand it better ?

Server

@Mahfuz_SS_EHL said:
Does Nameserver respond ? Can you inbox one domain name to understand it better ?

Hi, thanks for the reply. PM sent

cupcake

My #1 suspect is dnssec since it also happens to me a few times. While some registrar would handover old dnssec record just fine and your zone would work as usual, some fuck it up. Hell even if you transfer with dnssec disabled, some registrar would still fuck it up by auto enable it when you transfer over to them. Check at dnsviz. Disable/reenable dnssec would oftentime fix it.

JabJab

Agree with cupcake, sounds like DNSSEC. Disable that and see if CF will pick them up.

Harambe

It's always DNSSEC.

https://dnssec-debugger.verisignlabs.com/

Server

@cupcake said:
My #1 suspect is dnssec since it also happens to me a few times. While some registrar would handover old dnssec record just fine and your zone would work as usual, some fuck it up. Hell even if you transfer with dnssec disabled, some registrar would still fuck it up by auto enable it when you transfer over to them. Check at dnsviz. Disable/reenable dnssec would oftentime fix it.

Thanks for the reply. I've just checked, DNSSEC is not enabled. Just to be sure, I've save the 'Disabled' state on Cosmotown.

Server

@Harambe said:
It's always DNSSEC.

https://dnssec-debugger.verisignlabs.com/

Thanks for the reply!

I'm quite inexperienced with DNS, so I’m not entirely sure if I used the DNSSEC Debugger correctly — but I did try running a lookup on two domains: one that’s resolving properly, and one that isn’t.

I noticed that the domain that’s not resolving properly shows the following in the domain.com row:

Found 1 DS record for domain.com in the com zone    
DS=*snipped*/SHA-256 has algorithm ECDSAP256SHA256    
Found 1 RRSIG over DS RRset    
RRSIG=*snipped* and DNSKEY=*snipped* verifies the DS RRset

Meanwhile, the domain that is resolving fine doesn’t show this DNSSEC-related information on the debugger tool's domain.com row. Interestingly, Cosmotown’s dashboard doesn’t show that DNSSEC is enabled for this domain and I haven’t intentionally set up DNSSEC.

Would appreciate any help understanding what this implies and how I might go about fixing it if DNSSEC is indeed the issue. Thanks again!

Harambe

@Server said: Would appreciate any help understanding what this implies and how I might go about fixing it if DNSSEC is indeed the issue.

It means DNSSEC is enabled for that domain, and invalid since you updated the nameservers away from the old ones.

You need to find a way to disable/clear the DNSSEC keys in their panel - or reach out to them via support to do it. Has to happen on registrar side.