I have Hestia running on an Ubuntu VPS. The domain uses custom nameservers with glue pointing to the VPS, and some subdomains and mail records seem to work. But the main domain does not resolve, and Hestia cannot verify DNS when I request an SSL certificate. What should I check first?
Why does my domain apex not resolve with Hestia DNS?
Asked by
Ravelry+9
Answers
Check that ns1 and ns2 each have an A record in the DNS zone, pointing to the same VPS address as their registrar glue records. Glue tells resolvers where to find the nameservers, while the zone also needs those names to resolve. The zone should also have an A record for the apex, usually shown as @.
Reply to this answer
Test the DNS path in stages rather than relying on the control panel display. Query the VPS directly for the zone's SOA record, then trace the domain's A lookup from the public DNS hierarchy. If the VPS answers but the trace fails, focus on delegation, glue, firewall access to DNS, or DNSSEC configuration. If the VPS itself gives no useful answer, inspect the zone and Hestia's DNS service.
Reply to this answer
Also verify that the registrar is actually delegating the domain to the intended nameservers, and that the glue IPs match the VPS. A stale DNSSEC DS record left at the registrar after changing providers can make an otherwise correct zone fail for public resolvers, so check that too if the direct VPS query works.
Reply to this answer
From the records shown, the apex A record is present, but ns1 and ns2 don't appear to have A records inside the zone. Add those, make sure both names point to the right address, then allow for DNS caches to update before retrying certificate validation. The certificate error may just be reporting that public DNS cannot find the domain yet.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Ravelry+9:
That gives me a much better way to narrow down where the failure is.