From HEXONET Wiki
(→FAQs & Troubleshooting) |
|||
| (7 intermediate revisions by one user not shown) | |||
| Line 3: | Line 3: | ||
<p> | <p> | ||
| − | + | = Our brand new DNS service = | |
| − | + | HEXONET has recently upgraded its entire DNS service, with the support of our colleagues in the CentralNic Registry DNS team. Old servers have been retired and a brand new, state-of-the-art Anycast network has taken their place. 13 nodes in 5 continents, with hundreds of servers split in 3 separate clouds ensure that your domains resolve fast and securely all over the world. Our average response time has dropped from 131 to 28 milliseconds, a level of performance that most providers can barely dream of. | |
| − | + | DNS is a fundamental piece of a domain offering and we believe all customers should have access to a solid and secure DNS infrastructure. | |
| − | + | This is why we have retired our old Premium DNS offering and are making this new DNS service our standard option for all domains registered through HEXONET. | |
| − | |||
| − | |||
| − | |||
| − | + | To learn more about DNS management via the Control Panel, go to [[DNS in Control Panel]]. | |
| − | |||
| − | |||
| − | = | + | = How to use HEXONET DNS Service = |
| − | + | === Create new DNS zone === | |
| − | + | You can create a new DNS zone with the following command | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | === Create new DNS zone | + | |
| − | You can create | + | |
<pre> | <pre> | ||
| Line 55: | Line 24: | ||
</pre> | </pre> | ||
| − | |||
| − | |||
| − | + | === Create new DNS zone for a domain not registered with HEXONET === | |
| − | + | It is possible to use the HEXONET DNS service to host domains registered with other Registrars (also referred to as "external zones"). This service is currently offered at no charge until the end of 2021. Resellers should, however, be aware that charges will apply starting from January 1st, 2022. | |
| − | + | ||
| − | + | To create an external zone, use the optional flag EXTERNAL=1 | |
| − | + | ||
<pre> | <pre> | ||
| − | COMMAND = | + | COMMAND = CreateDNSZone |
| − | + | DNSZONE = (DNS zone name) | |
| − | DNSZONE = (DNS zone name) | + | EXTERNAL = 1 |
| − | + | ||
</pre> | </pre> | ||
| − | |||
| − | |||
| − | + | === Create new DNS zone for a domain that is about to be transferred HEXONET === | |
| − | + | It is possible to create a zone in the HEXONET DNS system in preparation for an incoming domain transfer to HEXONET. | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | To create this type of zone, use the optional flag DOMAINTRANSFER=1 | |
| − | + | ||
<pre> | <pre> | ||
| − | COMMAND = | + | COMMAND = CreateDNSZone |
DNSZONE = (DNS zone name) | DNSZONE = (DNS zone name) | ||
| + | DOMAINTRANSFER = 1 | ||
</pre> | </pre> | ||
| − | + | Please note that if the domain transfer is not completed within 14 days from the creation of the zone, the zone is automatically deleted from the HEXONET DNS system. | |
| − | + | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | === Get a list of all DNS zones === | |
| − | + | You can query a list of all DNS zone with the following command | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | == | + | |
| − | You can | + | |
<pre> | <pre> | ||
| − | COMMAND = | + | COMMAND = QueryDNSZoneList |
| − | + | ||
| − | + | ||
</pre> | </pre> | ||
| − | |||
| − | |||
| − | + | === Get information on a DNS zone === | |
| − | + | You can query all information regarding a DNS zone with the following command | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | You can | + | |
<pre> | <pre> | ||
| − | COMMAND = | + | COMMAND = StatusDNSZone |
DNSZONE = (DNS zone name) | DNSZONE = (DNS zone name) | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</pre> | </pre> | ||
| − | |||
=== Add and manage records === | === Add and manage records === | ||
| − | You can add and manage records for | + | You can add and manage records for a DNS zone with the following command |
<pre> | <pre> | ||
| Line 153: | Line 78: | ||
</pre> | </pre> | ||
| − | |||
| − | + | === Enable DNSSEC === | |
| − | + | You can enable DNSSEC on DNS zones using the following command | |
| − | You can enable DNSSEC | + | |
<pre> | <pre> | ||
| Line 194: | Line 117: | ||
</pre> | </pre> | ||
| − | === Disable DNSSEC | + | === Disable DNSSEC === |
| − | + | You can disable DNSSEC on a DNS zone with the following command | |
| − | + | ||
| − | + | ||
| − | You can disable DNSSEC | + | |
<pre> | <pre> | ||
| Line 206: | Line 126: | ||
</pre> | </pre> | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
= Zone Commands = | = Zone Commands = | ||
| Line 250: | Line 135: | ||
= Document Downloads = | = Document Downloads = | ||
| − | |||
Download: {{Template:Pdf|howTo_Nameserver_en.pdf| Virtual Nameserver Howto}} | Download: {{Template:Pdf|howTo_Nameserver_en.pdf| Virtual Nameserver Howto}} | ||
| + | |||
| + | |||
| + | = FAQs & Troubleshooting = | ||
| + | |||
| + | == I am experiencing some issues with intermittent connectivity to my domains and I believe the problem is with the DNS resolution. How can I troubleshoot this type of issues? == | ||
| + | First of all, you should verify that the data in the domain's zone is correct (e.g. the A record points to the right IP address) and that the server that is experiencing issues is configured correctly to accept incoming traffic. | ||
| + | |||
| + | If the zone data is correct, you should then confirm that the domain in question is using only the nameservers provided by HEXONET (you can see the nameservers assigned to your account by logging onto the HEXONET web-interface). | ||
| + | |||
| + | All 3 nameservers assigned to your account should be listed in the domain's WHOIS. If any are missing, or if there are additional 3rd party nameservers, please update the domain in question to only list all 3 of the HEXONET nameservers assigned to your account. In case you are using vanity nameservers, you should also test replacing them with the hostnames provided in the HEXONET web-interface. | ||
| + | |||
| + | If all of the above items have been checked and the issue still persists, please contact our Support team for further investigation (see the following question for additional information you should provide when opening the support ticket to ensure a speedy handling of your case). | ||
| + | |||
| + | |||
| + | == What information do I need to provide to investigate a particular behaviour == | ||
| + | Because our system uses anycast, we need to know which of our PoPs your queries are going to: the IP address itself isn’t enough, since it’s shared across many locations. So any dig or nslookup command will not give the information that we need to debug where the problem is. | ||
| + | |||
| + | The following command line tools should be used: | ||
| + | |||
| + | * MTR → https://www.youtube.com/watch?v=1g64C4t4zGI | ||
| + | * traceroute -A https://www.youtube.com/watch?v=YzyHXHJl_mU | ||
| + | * dig yourdnsnamehere.com +nsid → https://www.youtube.com/watch?v=UAlzss-9sH0 | ||
| + | * dig soa yourdnsnamehere.com +nsid | ||
| + | |||
| + | Providing this information when you open a Support ticket will help us handle your request and find a solution a lot faster. | ||
| + | |||
| + | |||
| + | == Why is my traffic ending up in another node? == | ||
| + | |||
| + | Our Anycast networks use BGP to distribute traffic to different upstream providers around the world. These upstream providers range from Tier 1 level, the likes of Cogent, NTT, GTT, or others, and lower tiers which are local in a continent or a country, and traffic via Internet Exchanges which is either by using their route servers or through direct peering. | ||
| + | |||
| + | A BGP relationship is best effort by default, and once traffic leaves the premise it will be in the *total* control of upstream providers. Some upstream providers have pre-defined agreements that will influence the route the traffic will take once our packet leaves our network. | ||
| + | |||
| + | Due to loss of control of traffic once passed on to upstream providers, DNS clients traffic might be forwarded to nodes that are quite far in both terms of network connectivity and geographical distance. | ||
| + | |||
| + | For instance, a client in North America could see their DNS query routing towards a node in South Africa, when in fact the query should have been directed towards the many nodes available in North America. | ||
| + | |||
| + | Many providers will change their internal routing configuration after we contact them if we find an issue, but big players in the market like Hurricane Electric, never do so. Whilst we stopped our direct peering with them, many of our upstream providers use them as one of their own upstream connections. | ||
| + | |||
| + | Our DNS team continuously tracks those issues and contact suppliers where possible. Most of the time those issues get resolved, however it always takes time. We also employ the use of BGP communities where applicable, to influence how our upstreams route traffic. | ||
Latest revision as of 17:28, 2 December 2021
[edit] Our brand new DNS service
HEXONET has recently upgraded its entire DNS service, with the support of our colleagues in the CentralNic Registry DNS team. Old servers have been retired and a brand new, state-of-the-art Anycast network has taken their place. 13 nodes in 5 continents, with hundreds of servers split in 3 separate clouds ensure that your domains resolve fast and securely all over the world. Our average response time has dropped from 131 to 28 milliseconds, a level of performance that most providers can barely dream of.
DNS is a fundamental piece of a domain offering and we believe all customers should have access to a solid and secure DNS infrastructure.
This is why we have retired our old Premium DNS offering and are making this new DNS service our standard option for all domains registered through HEXONET.
To learn more about DNS management via the Control Panel, go to DNS in Control Panel.
[edit] How to use HEXONET DNS Service
[edit] Create new DNS zone
You can create a new DNS zone with the following command
COMMAND = CreateDNSZone DNSZONE = (DNS zone name)
[edit] Create new DNS zone for a domain not registered with HEXONET
It is possible to use the HEXONET DNS service to host domains registered with other Registrars (also referred to as "external zones"). This service is currently offered at no charge until the end of 2021. Resellers should, however, be aware that charges will apply starting from January 1st, 2022.
To create an external zone, use the optional flag EXTERNAL=1
COMMAND = CreateDNSZone DNSZONE = (DNS zone name) EXTERNAL = 1
[edit] Create new DNS zone for a domain that is about to be transferred HEXONET
It is possible to create a zone in the HEXONET DNS system in preparation for an incoming domain transfer to HEXONET.
To create this type of zone, use the optional flag DOMAINTRANSFER=1
COMMAND = CreateDNSZone DNSZONE = (DNS zone name) DOMAINTRANSFER = 1
Please note that if the domain transfer is not completed within 14 days from the creation of the zone, the zone is automatically deleted from the HEXONET DNS system.
[edit] Get a list of all DNS zones
You can query a list of all DNS zone with the following command
COMMAND = QueryDNSZoneList
[edit] Get information on a DNS zone
You can query all information regarding a DNS zone with the following command
COMMAND = StatusDNSZone DNSZONE = (DNS zone name)
[edit] Add and manage records
You can add and manage records for a DNS zone with the following command
COMMAND = UpdateDNSZone DNSZONE = (DNS zone name) ADDRR0 = (add new record) DELRR0 = (remove record)
[edit] Enable DNSSEC
You can enable DNSSEC on DNS zones using the following command
COMMAND = UpdateDNSZone DNSSEC-MODE = AUTO DNSZONE = (DNS zone name)
Once enabled, you must input the DS and KEY records into the respective domain. You can get the DS and KEY record information by executing the following command
[COMMAND] COMMAND = StatusDNSZone DNSZONE = (DNS zone name) EOF [RESPONSE] CODE = 200 DESCRIPTION = Command completed successfully PROPERTY[DNSSEC-DS-SHA-1][0] = 20407 8 1 040772816032dc2a675d7f74725d747e47c45185 PROPERTY[DNSSEC-DS-SHA-256][0] = 20407 8 2 a1dd1c5c5d78cd71477472ec5a3eeeaee65ecbc461b63ecd4630fd44d9492028 PROPERTY[DNSSEC-KEY][0] = 257 3 8 AwEAAbfEdVJVqSuGwU8XEAtUWtODHv2CNPAwDKATFs0V17O2/Qe+vSUPadWNISqhSr7wAVrNxdNbOPxzw/iF8xN84GN3hArecKhX/+Yb6fSsucqkwd8fuloU+jTBAl4dq7LRM5DbqdLrN6MUyq1p2h86lP9pXjEaeTYtZ0i8zeV7IyG4d/q+FTNG+1Daw90YIvyFdek1HnNd9pXRSeYhdB8GyxZAGPPID0NBk5/L/nY3mCTi7ezQ7UsdVuB/W53sjlSgjgfFnxsqanN0XK87liuZ8fSMi84CPRTqoYglIBUVxHtTlZIN7Xg72g5HsNzX3EEQfcvkB4h62CcBKX3AIron3zc= PROPERTY[DNSSEC-KEY-TAG][0] = 20407 PROPERTY[DNSSEC-MODE][0] = AUTO ... EOF
To input the records into the domain, execute the following command
COMMAND = ModifyDomain ADDSECDNS-DS0 = (DNSSEC-DS from StatusDNSZone, you can choose either SHA-1 or SHA-256) ADDSECDNS-KEY0 = (DNSSEC-KEY from StatusDNSZone) DOMAIN = (domain name)
[edit] Disable DNSSEC
You can disable DNSSEC on a DNS zone with the following command
COMMAND = UpdateDNSZone DNSSEC-MODE = DISABLED DNSZONE = (DNS zone name)
[edit] Zone Commands
HEXONET's DNS service platform was designed to dramatically simplify the management of DNS. More Information
- How to use HEXONET's DNS with your domains
- DNSSEC API Command Extensions
- HEXONET's extended DNS Solutions
[edit] Document Downloads
Download: Virtual Nameserver Howto
[edit] FAQs & Troubleshooting
[edit] I am experiencing some issues with intermittent connectivity to my domains and I believe the problem is with the DNS resolution. How can I troubleshoot this type of issues?
First of all, you should verify that the data in the domain's zone is correct (e.g. the A record points to the right IP address) and that the server that is experiencing issues is configured correctly to accept incoming traffic.
If the zone data is correct, you should then confirm that the domain in question is using only the nameservers provided by HEXONET (you can see the nameservers assigned to your account by logging onto the HEXONET web-interface).
All 3 nameservers assigned to your account should be listed in the domain's WHOIS. If any are missing, or if there are additional 3rd party nameservers, please update the domain in question to only list all 3 of the HEXONET nameservers assigned to your account. In case you are using vanity nameservers, you should also test replacing them with the hostnames provided in the HEXONET web-interface.
If all of the above items have been checked and the issue still persists, please contact our Support team for further investigation (see the following question for additional information you should provide when opening the support ticket to ensure a speedy handling of your case).
[edit] What information do I need to provide to investigate a particular behaviour
Because our system uses anycast, we need to know which of our PoPs your queries are going to: the IP address itself isn’t enough, since it’s shared across many locations. So any dig or nslookup command will not give the information that we need to debug where the problem is.
The following command line tools should be used:
- MTR → https://www.youtube.com/watch?v=1g64C4t4zGI
- traceroute -A https://www.youtube.com/watch?v=YzyHXHJl_mU
- dig yourdnsnamehere.com +nsid → https://www.youtube.com/watch?v=UAlzss-9sH0
- dig soa yourdnsnamehere.com +nsid
Providing this information when you open a Support ticket will help us handle your request and find a solution a lot faster.
[edit] Why is my traffic ending up in another node?
Our Anycast networks use BGP to distribute traffic to different upstream providers around the world. These upstream providers range from Tier 1 level, the likes of Cogent, NTT, GTT, or others, and lower tiers which are local in a continent or a country, and traffic via Internet Exchanges which is either by using their route servers or through direct peering.
A BGP relationship is best effort by default, and once traffic leaves the premise it will be in the *total* control of upstream providers. Some upstream providers have pre-defined agreements that will influence the route the traffic will take once our packet leaves our network.
Due to loss of control of traffic once passed on to upstream providers, DNS clients traffic might be forwarded to nodes that are quite far in both terms of network connectivity and geographical distance.
For instance, a client in North America could see their DNS query routing towards a node in South Africa, when in fact the query should have been directed towards the many nodes available in North America.
Many providers will change their internal routing configuration after we contact them if we find an issue, but big players in the market like Hurricane Electric, never do so. Whilst we stopped our direct peering with them, many of our upstream providers use them as one of their own upstream connections.
Our DNS team continuously tracks those issues and contact suppliers where possible. Most of the time those issues get resolved, however it always takes time. We also employ the use of BGP communities where applicable, to influence how our upstreams route traffic.