DNS System Question

RJM62

Touchdown! Greaser!
Joined
Jun 15, 2007
Messages
13,157
Location
Upstate New York
Display Name

Display name:
Geek on the Hill
If a domain name is transferred to a new registrar, and that domain name also has nameservers attached to it, the nameservers have to be re-glued when the domain is transferred.

What I am wondering is whether the DNS system caches the nameserver addresses for several days between when the move takes effect and the records at the new registrar propagate.

Thanks.

Rich
 
If a domain name is transferred to a new registrar, and that domain name also has nameservers attached to it, the nameservers have to be re-glued when the domain is transferred.

What I am wondering is whether the DNS system caches the nameserver addresses for several days between when the move takes effect and the records at the new registrar propagate.

Thanks.

Rich

Yes, it can happen. What's the TTL on your DNS records?
 
Yes, it can happen. What's the TTL on your DNS records?

14400. But I can change that prior to the move, if it happens.

I'm actually very surprised that the records for the glued nameservers don't automatically transfer with the domain. I always thought they did.

Rich
 
Rich, can you explain what you mean by "glued" name servers? Are you just speaking of the delegation from the TLD servers to the registrar? Most registrars just manipulate the TLD directly to delegate to your name servers and their servers don't have to be involved at all in a query when done correctly. Depends on the TLD and how it's run.

The answers about the TTL of the SOA record and individual records are also apropos.

Reverse records are handled differently because of the need to split the delegation of the old classful IP makeup of in-addr.arpa.
 
By the way. In practice, with tons of caching servers cascaded behind caching servers, expect up to three times the TTLs being the last time you'll see things hitting the old records, for a general rule of thumb.

Especially nowadays when desktop machines are building their own caches. Ick. Many of them do not play TTL nor do updates properly.
 
Rich, can you explain what you mean by "glued" name servers? Are you just speaking of the delegation from the TLD servers to the registrar? Most registrars just manipulate the TLD directly to delegate to your name servers and their servers don't have to be involved at all in a query when done correctly. Depends on the TLD and how it's run.

The answers about the TTL of the SOA record and individual records are also apropos.

Reverse records are handled differently because of the need to split the delegation of the old classful IP makeup of in-addr.arpa.

By the way. In practice, with tons of caching servers cascaded behind caching servers, expect up to three times the TTLs being the last time you'll see things hitting the old records, for a general rule of thumb.

Especially nowadays when desktop machines are building their own caches. Ick. Many of them do not play TTL nor do updates properly.

What I'm talking about are the records held by the registrar pointing the nameservers to the correct IP addresses within the .com TLD. The IP addresses, SOA, and nameservers wouldn't be changing, just the domain registrar.

What I think I'm getting is that that would stay the same, anyway, because it's already been done at TLD level and the registrar's pretty much out of the equation after that. Am I correct?

I'm not concerned about local caching because the IP addresses would be staying the same anyway. I'm also not sure whether in this case, where the IP addresses would be staying the same, there would be any benefit in shortening the TTL.

Rich
 
As you may have gathered, I'm pizzed off at my registrar. Big outfit owned by a guy named Bob.

Rich
 
I think you're playing with fire trying this. Seems like a good way to knock yourself offline for days. If it mattered at all no way in hell I'd do it. I'd either leave the domain at the registrar or migrate whatever is dependent on those records to something else.

I don't run DNS anymore if I can avoid it. Route53 just works way too well.

I suspect you just have a domain using itself for DNS? If so change that domain to use something else for DNS in the mean time.

For those that don't know what he's talking about -- imagine this scenario.

You have domain example.com. You want the NS records for Example.com to point to ns1.example.com and ns2.example.com. See the problem here? Kind of a circular dependency.

To solve this you can create glue records with your registrar to point ns1.example.com to an ip and ns2.example.com to an ip.

Trusting that all hell wouldn't break loose moving registrars isn't something I would bet on for anything that mattered.

I'd suggest you just migrate DNS for that domain to route53 before the move. You can literally just copy and paste a bind zone file into Route53 and it'll recreate it. Then change the NS records for that domain to Route53. Move back to your own solution once you change registrars if you want. It'll cost you like less than a dollar in Amazon fees.
 
Last edited:
If I have a major change, I'll go about 3x the TTL beforehand and drop the TTL down to a very low value (like 5 minutes). Yes, it hammers the NSs, but then when you make the swap, set you new SOA to have the longer TTL, and as soon as folks change over, they'll get the new longer TTL.
 
Last edited by a moderator:
Btw, JeffDG you'll see edited by Jesse on your post. I clicked the wrong button and edited yours instead of mine. I then reverted that. Your post should be what you wrote now. Sorry about that.
 
Btw, JeffDG you'll see edited by Jesse on your post. I clicked the wrong button and edited yours instead of mine. I then reverted that. Your post should be what you wrote now. Sorry about that.

No biggie.
 
I think you're playing with fire trying this. If it mattered at all no way in hell I'd do it. I'd either leave the domain at the registrar or migrate whatever is dependent on those records to something else.

That was my other idea: Just leave the domains with nameservers where they are and move the rest.

I don't run DNS anymore if I can avoid it. Route53 just works way too well.

You're the second person to mention Route53 to me this week. The first was in connection to a failover server I'm planning to build. He told me that using Route53 would make that a lot simpler. Now I have to check it out.

I suspect you just have a domain using itself for DNS? If so change that domain to use something else for DNS in the mean time.

There are many domains using the nameservers, and some of their owners are... let's just say not mavens about things technical. Telling them that they need to log in to their registrars to change the nameservers for their domains will elicit the questions of, "What's a registrar?", "Who's my registrar?", "What's my password?", etc. You know the type. That's why it's been more than 10 years since I've changed a nameserver's name.

Thanks.

Rich
 
That was my other idea: Just leave the domains with nameservers where they are and move the rest.



You're the second person to mention Route53 to me this week. The first was in connection to a failover server I'm planning to build. He told me that using Route53 would make that a lot simpler. Now I have to check it out.



There are many domains using the nameservers, and some of their owners are... let's just say not mavens about things technical. Telling them that they need to log in to their registrars to change the nameservers for their domains will elicit the questions of, "What's a registrar?", "Who's my registrar?", "What's my password?", etc. You know the type. That's why it's been more than 10 years since I've changed a nameserver's name.

Thanks.

Rich

You don't need to do it for their domains. Just the one that is *using itself* for DNS.

example.com with an NS server of ns1.example.com (GLUE RECORD NECESSARY)

example.com with an NS server of ns1.example.net (GLUE RECORD NOT NECESSARY)
example.net with an NS server of ns1.example.com (GLUE RECORD NOT NECESSARY)
 
Last edited:
You don't need to do it for their domains. Just the one that is *using itself* for DNS.



example.com with an NS server of ns1.example.com (GLUE RECORD NECESSARY)



example.com with an NS server of ns1.example.net (GLUE RECORD NOT NECESSARY)

example.net with an NS server of ns1.example.com (GLUE RECORD NOT NECESSARY)


Exactly.

Let me be number three or four to mention Route53. We are seriously considering migrating everything public to it at the workplace.
 
You don't need to do it for their domains. Just the one that is *using itself* for DNS.

I'm not sure I get you...

I'm running DNS using NS1.MYDOMAIN.COM and NS2.MYDOMAIN.COM, on a server named SERVER1.MYDOMAIN.COM, and providing DNS for other sites on that and other servers. How would changing only MYDOMAIN.COM's nameservers protect the other domains from losing DNS services if the glue disappears from the TLD once MYDOMAIN.COM is transferred to another registrar?

Rich

EDIT: Ah, okay. I get it.
 
Exactly.

Let me be number three or four to mention Route53. We are seriously considering migrating everything public to it at the workplace.

I'll have to check them out. I've already started using AWS for some of my server backups (on I believe Jesse's advice) and wouldn't mind using them for other services if they do it better than I do... which isn't all that difficult...

I'm working on a failover server for some clients who need exceptional high availability, and just reading though the introductory page for Route53, it looks like Route53 could be part of that project. Thanks.

Rich
 
Fwiw if you want a no nonsense registrar I would transfer the domain to Amazon Route 53's registrar service. They became a registrar last year I think. Probably not the cheapest pricing but a very simple to the point system. They'll autorenew and your domain fees will be bundled with your AWS fees plus you can then protect your domain management with their consoles multi factor auth feature.

I've moved all the mission critical domains I manage to them and I suspect we'll end up doing that across our company in the next year or two.
 
Fwiw if you want a no nonsense registrar I would transfer the domain to Amazon Route 53's registrar service. They became a registrar last year I think. Probably not the cheapest pricing but a very simple to the point system. They'll autorenew and your domain fees will be bundled with your AWS fees plus you can then protect your domain management with their consoles multi factor auth feature.

I've moved all the mission critical domains I manage to them and I suspect we'll end up doing that across our company in the next year or two.

Thanks, I was looking at that, actually.

The reason for my anger at Bob's company had to do with a forwarded email I received from a client this morning. I am the Admin, Billing, and Technical contact for this client, and his three domains are on my account. This is because he's forgotten to renew them some years, and paid scam artists money to "renew" them in the alternate years; so either way, the sites have been down a few times for non-renewal of the registration.

I finally put the domains on my account to make sure they got renewed, but kept the client in WHOIS as the registrant. So Bob sent me the 90-day renewal and CC'd the client on it. The problem is that the email contained notices for those domains as well as nine others coming due on my account. Worse yet, it contained a link to a list of ALL my domains that are registered at Bob's outfit.

I was pretty much flabbergasted that they would do something like that. So I called them, and they told me "that's how the mail system is set up" and that there's nothing they could do about it other than to change all the registrants for domains that I manage, but don't own, to myself.

I refuse to do that because I consider it unethical. It would make the clients and their domains hostage to me. I know guys who do that and I detest the practice. But as long as I keep the clients down as registrants, they get a copy of whatever mail Bob sends me when their domains happen to be coming up for renewal, including whatever other domains are coming due, along with a link to my entire domain portfolio.

It's not that I have any secrets in there. I just consider the practice irresponsible. And then there's Bob's annoying habit of requiring me to decline a bazillion other services that his company provides every time I register a domain, but that's another story.

The only thing I do like about Bob is that he lets me pay by PayPal. I don't like anyone storing my credit card numbers if I can possibly avoid it. I've had to get my cards replaced too many times already because of that. I got caught up in the Adobe hack, the Target hack, the FoodTown hack, and the Home Depot hack. It's getting pretty damn tiresome.

Amazon already has one of my cards on file, however, so it would be no additional risk. Or I could just get their own card and use it only for Amazon, which is something I probably should do anyway. It minimizes the inconvenience should Amazon get hacked.

I do like AWS S3, though. It's probably the best place to stash server backups that I've ever come across. It's cheap, trouble-free, and about as secure as it gets. I'm pretty sure it was you who suggested them a few months ago, so thanks for that.

Rich
 
Last edited:
Back
Top