[Tom]

This should be fixed now, there may be a requirement for this to propagate through the internet (24 hrs)

; <<>> DiG 9.6.0-APPLE-P2 <<>> www.blackberryforums.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12766
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;www.blackberryforums.com. IN A

;; ANSWER SECTION:
www.blackberryforums.com. 14180 IN CNAME blackberryforums.com.
blackberryforums.com. 14180 IN A 74.86.254.234

;; AUTHORITY SECTION:
blackberryforums.com. 68119 IN NS dns1.blackberryserver.com.
blackberryforums.com. 68119 IN NS dns2.blackberryserver.com.

;; Query time: 24 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Mon Mar 8 01:52:47 2010
;; MSG SIZE rcvd: 127

[John Clark]

Most excellent. Thanks Tom!

[the-economist]

Originally Posted by Tom

This should be fixed now, there may be a requirement for this to propagate through the internet (24 hrs)

You're getting a reply from 192.168.x.x, that's RFC1918 private space. You're not getting an authoritative network-side answer. That's your caching DNS responding there.

[jsconyers]

I was experience this issue all weekend as well. I will try again tonight when I am home. Thanks for the update, Tom.

[aharrison]

Originally Posted by Tom

This should be fixed now, there may be a requirement for this to propagate through the internet (24 hrs)

Problem will still exist because of this new behavior from Verisign. The glue records for blackberryserver.com are busted. Actually, now that I look closer, the problem is about to get much much worse from the way it was fixed.

The authoritative servers for blackberryforums.com:

# whois blackberryforums.com | grep -A2 'Name Servers:'
Name Servers:
   ns1.blackberrycenter.com
   ns2.blackberrycenter.com

The NS records for blackberryforums.com, querying their authoritative servers directly so there are no ttl issues:

# dig NS blackberryforums.com @ns1.blackberrycenter.com

; <<>> DiG 9.5.0-P2 <<>> NS blackberryforums.com @ns1.blackberrycenter.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6758
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;blackberryforums.com.          IN      NS

;; ANSWER SECTION:
blackberryforums.com.   86400   IN      NS      dns1.blackberryserver.com.
blackberryforums.com.   86400   IN      NS      dns2.blackberryserver.com.

;; ADDITIONAL SECTION:
dns1.blackberryserver.com. 14400 IN     A       74.86.254.232
dns2.blackberryserver.com. 14400 IN     A       74.86.254.233

;; Query time: 55 msec
;; SERVER: 74.86.254.234#53(74.86.254.234)
;; WHEN: Mon Mar  8 10:49:35 2010
;; MSG SIZE  rcvd: 125

The record looks good on the surface. They kept the dns[12].blackberryserver.com NS records and ditched the rest. But dig a little deeper.

Find the authoritative servers for blackberryserver.com because the names dns[12].blackberryserver.com need to be resolved to complete the original query of looking up names for blackberryforums.com:

# whois blackberryserver.com | grep -A2 'Name Servers:'
Name Servers:
   ns1.blackberryserver.com
   ns2.blackberryserver.com

So, ns[12].blackberryserver.com are authoritative for blackberryserver.com Query the NS records for blackberryserver.com, again, directly from the authoritative server so there are no ttl issues:

# dig NS blackberryserver.com @ns1.blackberryserver.com
dig: couldn't get address for 'ns1.blackberryserver.com': not found

(insert sound of screeching halt here)

This is the new behavior described by the verisign change doc. While the name servers dns[12].blackberrycenter.com are configured to provide A records for dns[12].blackberryserver.com, they are now irrelevant because the blackberrycenter.com servers are not authoritative for blackberryserver.com. So, where Verisign's root name servers for all of the .com namespace used to be helpful and just grab those glue records, it will not now promote those records to be authoritative.

Because the records for blackberryforums.com on dns[12].blackberrycenter.com now only contain NS records pointing to dns[12].blackberryserver.com, this problem is about to get much worse as soon as the TTL for all the glue records expire for blackberryforums.com.

So, the glue records for blackberryserver.com need to get fixed very soon, or the blackberryserver.com name servers need to be taken completely out of the mix.

[arieltf]

My workaround was to add the Google Public DNS server, 8.8.8.8, to my DNS list.

Now I have access to blackberryforums.com

--Ariel

[aharrison]

Originally Posted by arieltf

My workaround was to add the Google Public DNS server, 8.8.8.8, to my DNS list.

Now I have access to blackberryforums.com

--Ariel

That will work for 5363 more seconds. ;)

[arieltf]

Originally Posted by aharrison

That will work for 5363 more seconds. ;)

Was that a joke? If so, I don't get it.

--Ariel

[aharrison]

Originally Posted by arieltf

Was that a joke? If so, I don't get it.

--Ariel

Nope. That's how long it had left before the ttl of the A record expires. It should start getting uglier as these ttl times start expiring across the internet.

[Noodle22]

It's now happening to me on my work computer, unfortuantely I can't alter anything here so I'm stuck without BBF for now It just started working again, but who knows for how long.

[SteveO86]

I see, It appears out friend VIOLATOR is also having this problem. (Chatting with him on BBM) He is unable to get here. So I will post for him

[tsac]

Still seeing some DNS issues randomly

[SteveO86]

The WAP site is timing out for me.

On my BB.

[jsconyers]

Experienced issues at work an at home most of the day yesterday.

[Noodle22]

I'm praying this gets fixed before I get to work, I don't want to be tempted to smoke on my breaks and this site is a great distraction

[Dubdub]

Worked fine at home this morning - Comcast cable. No go in the Office from about 9 AM until now when I finally go in - Fairpoint DSL.

[angelbear1973]

This since the first time I have seen the site since the 4th, other than on my BB

[Raptor464]

I haven't had any issues with getting to the site!

[ifonline]

Hasn't worked at home for several days now, and hardly works at the office. I am actually surprised I got through just now to be able to post this.

[aharrison]

I attempted to also email my post about the dns problems to tom at the kwlt.net address that shows in his profile here, but since the name server that's authoritative for kwlt.net is also incorrectly configured, I eventually just got a bounce message saying that it couldn't resolve the name.