I had a strange situation the last few days where I was pointing the DNS records from my registrar to my own DNS server and DNS was not propagating. I have done this before successfully and was under the impression that it was trivial until now. So when the domain took longer than 2 days to propagate, I decided to confront my registrar who pointed me to http://leafdns.com which stated the following:

ns1.mydomain.com - Nameserver is not authoritative for mydomain.com ns2.mydomain.com - Nameserver is not authoritative for mydomain.com None of the nameservers listed by the parent nameservers are both responsive and authoritative for your domain. This error is fatal and the domain is unresolveable.

I was buffled as to why this was happenning so I visited other services like https://viewdns.info/dnsreport/ which pointed to this:

Check that all nameservers respond: Oops! The following nameservers listed at the parent servers didn't respond to DNS requests: ns1.mydomain.com ns2.mydomain.com

Nameservers allow TCP connections: Oops! We couldn't connect to the following nameservers using TCP on port 53: ns1.mydomain.com ns2.mydomain.com

I started thinking that something was wrong with my firewall, so since yesterday I have been messing around with that, until I allowed all traffic through only to see no change to the above reports! What was going on? The only thing remaining was BIND. Something must be wrong in BIND. Why won't it communicate? I did have a quick look at syslog before, but didn't notice any errors.

So I checked BIND status, restarted it and checked the status again. Nothing to write home about.


So I decided to empty syslog and restart BIND. I checked syslog line by line and saw this, which drew my attention:

/var/lib/bind/mydomain.com.hosts:20: unknown RR type 'mydomain.com.'
zone mydomain.com/IN: loading from master file /var/lib/bind/mydomain.com.hosts failed: unknown class/type
zone mydomain.com/IN: not loaded due to errors.
all zones loaded

I opened /var/lib/bind/mydomain.com.hosts and sure enough on line 20 was the problem which stopped BIND from loading the zone for my ns1.

mydomain.com. IN CAA 0 issue "letsencrypt.org"   mydomain.com. IN CAA 0 issuewild ";"

Removing this line fixed everything, the zone loaded and BIND started talking to his peers again.

The reason was because this line was wrongly defined.

This line should have been defined on 2 separate lines like this:

mydomain.com. IN CAA 0 issue "letsencrypt.org"
mydomain.com. IN CAA 0 issuewild ";"

Hope this is of some help to others.

UPDATE: After further investigation, I discovered that this was caused by a bug in Virtualmin as I outline in this bug report: https://www.virtualmin.com/node/66527.

If you specify 2 or more lines in Virtualmin>System Settings>Server Templates>Default Settings>BIND DNS domain>BIND DNS records for new domains, these lines are joined into a single line, whenever you create a new domain. This is the root cause of the problem.

  • 1
    Looking at log file is indeed the first step in any troubleshooting. Note also these 2 handy tools for bind: named-checkconf and named-checkzone. You can use them on new configuration/zones before restarting anything. – Patrick Mevzek Jul 5 at 18:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.