Page MenuHomePhabricator

Faulty DNS setup for wikipedia.is
Closed, ResolvedPublic

Description

I received a notice from our registrar that there is a faulty DNS setup for wikipedia.is

We need to resolve the issue within three weeks to maintain our registration. Please follow up with me via email if you need more details.

Thanks!

Event Timeline

Slaporte raised the priority of this task from to High.
Slaporte updated the task description. (Show Details)
Slaporte added projects: DNS, Domains.
Slaporte subscribed.

Change 221148 had a related patch set uploaded (by Glaisher):
Redirect wikipedia.is to is.wikipedia.org

https://gerrit.wikimedia.org/r/221148

@Slaporte It looks to me like DNS itself is actually fine, it points to our servers. Just that the webserver didn't have any config for it. So it showed:

Domain not configured

This domain points to a Wikimedia Foundation server, but is not configured on this server.

at http://wikipedia.is/

Glaisher uploaded a change to fix that, but it doesn't seem to match the description of "faulty DNS setup".
Could you paste more details from their mail?

Change 221148 merged by Dzahn:
Redirect wikipedia.is to is.wikipedia.org

https://gerrit.wikimedia.org/r/221148

Hi @Dzahn, this is what I got from the registrar:

The following errors are registered when ISNIC attempts to check the zone for domain wikipedia.is:

Test results for "NS0.WIKIMEDIA.ORG":
The serial number is not in sync with the primary nameserver
Test results for "NS2.WIKIMEDIA.ORG":
The serial number is not in sync with the primary nameserver

@Glaisher: We ran into a very strange bug when trying to add that seeminly easy redirect. see below

https://gerrit.wikimedia.org/r/#/c/221282/
https://gerrit.wikimedia.org/r/#/c/221291/

@Slaporte Ok, that would be unrelated to the missing Apache redirect. We'll get into that seperately.

Hi @Dzahn, this is what I got from the registrar:

The following errors are registered when ISNIC attempts to check the zone for domain wikipedia.is:

Test results for "NS0.WIKIMEDIA.ORG":
The serial number is not in sync with the primary nameserver
Test results for "NS2.WIKIMEDIA.ORG":
The serial number is not in sync with the primary nameserver

Currently, I can confirm no such problem exists (and I didn't do anything to fix it). All 3x of our nameservers report identical SOA's, including the serial. Here's the raw dig output, as well as a double-check with md5 hashing to ensure there's no obscure typo that's hard for humans to notice:

bblack-mba:~ bblack$ for x in 0 1 2; do dig +short @ns$x.wikimedia.org wikipedia.is SOA; done
ns0.wikimedia.org. hostmaster.wikimedia.org. 2015061022 43200 7200 1209600 3600
ns0.wikimedia.org. hostmaster.wikimedia.org. 2015061022 43200 7200 1209600 3600
ns0.wikimedia.org. hostmaster.wikimedia.org. 2015061022 43200 7200 1209600 3600
bblack-mba:~ bblack$ for x in 0 1 2; do dig +short @ns$x.wikimedia.org wikipedia.is SOA|md5; done
730520d5fee01dde09ba1144a71f75d1
730520d5fee01dde09ba1144a71f75d1
730520d5fee01dde09ba1144a71f75d1

Their checking of this, if it's an automated check on a periodic basis, seems non-sensical to me in the first place. As changes are rolled out to nameservers, serial numbers get updated, and there is never perfect sync between the multiple nameservers for a domainname. Most of the time SOA serials would be in sync, but there will always be race-conditions where the serials are temporarily out of sync during updates. If it's just a one-time check when first registering, I guess it's not bad as a sanity measure, but still they must have just had really bad timing when checking it...

Change 221877 had a related patch set uploaded (by Glaisher):
Redirect wikipedia.is to is.wikipedia.org

https://gerrit.wikimedia.org/r/221877

Change 221877 merged by Dzahn:
Redirect wikipedia.is to is.wikipedia.org

https://gerrit.wikimedia.org/r/221877

the redirects work now, merged and deployed.

[terbium:~] $ apache-fast-test iswiki.urls mw1033
testing 4 urls on 1 servers, totalling 4 requests
spawning threads..

http://wikipedia.is
 * 301 Moved Permanently http://is.wikipedia.org/
http://wikipedia.is/wiki/
 * 301 Moved Permanently http://is.wikipedia.org/wiki/
http://www.wikipedia.is
 * 301 Moved Permanently http://is.wikipedia.org/
https://wikipedia.is
 * 301 Moved Permanently https://is.wikipedia.org/
Dzahn set Security to None.

Can we close this now? @Slaporte Can you ask for reconfirmation from them?

fgiunchedi claimed this task.
fgiunchedi subscribed.

looks like this is completed

$ dig +short wikipedia.is ns
ns2.wikimedia.org.
ns0.wikimedia.org.
ns1.wikimedia.org.
$ curl -v -L wikipedia.is 2>&1 | grep Location
< Location: http://is.wikipedia.org/
< Location: https://is.wikipedia.org/
< Location: https://is.wikipedia.org/wiki/Fors%C3%AD%C3%B0a

The registrar confirmed that this is resolved. Thanks!