Domain oddity - possibly early warning...

Thu Mar 27 15:05:58 UTC 2003

Thanks for the response Matt... more below...

Matt Larson wrote:
> 
> On Tue, 25 Mar 2003, Rodney Joffe wrote:
> > We've noticed something we've never noticed before that became evident
> > at 14:00 today...  and which could be an isolated glitch at
> > Verisign/Netsol, or it could be a sign of a larger problem looming.
> 
> Or perhaps it could be the result of perfectly normal operations.

for various values of normal ;-)

> This behavior is normal.  The owning registrar for this domain,
> Network Solutions, removed both name servers during the evening (EST)
> of 24 March.  A domain with no name servers is a legal state in the
> com/net registry database.  In such a case, however, the domain does
> not appear in the com/net zones.  (How could it--it has no name
> servers.)  The domain was again modified during the evening (EST) of
> 25 March, when two name servers were added.  It was therefore included
> in the com zone with SOA serial 2003032600.

OK...

> This is a good opportunity to point out the separation between
> VeriSign Global Registry Services (VGRS), the registry for com/net,
> and the various ICANN-accredited registrars, including Network
> Solutions.  VGRS makes whatever changes requested by registrars to
> domains they own.  In this case, we just see that the name servers
> were removed and re-added a day later.  Presumably Network Solutions
> took this action based on customer instructions, but you'd have to ask
> them.

We did. The customer did not provide any instructions to NSI to cause
the deletion of the nameservers. NSI's response to the phone call was to
re-enter the nameservers through the UI which they then did, and as you
say, the nameservers re-appeared following the next zone push.
However... and this is where it takes on more general relevance...

I received some 30+ private emails citing similar experiences going back
2 years. And one in particular that may actually provide a clue to the
root cause (assuming NSI is interested). One of the respondents
suggested that based on his experience, perhaps NSI was running a select
statement against the database as a change was being made, and perhaps
record locking played a part. I then queried the customer who confirmed
that they had applied changes to *other* domains in their *account* at
NSI during the day the record first disappeared.  I have so far been
able to confirm with two of the other folks who sent mail that they had
made changes on the day of, or before, the records disappeared. And they
were adamant that they had *not* deleted the nameservers from their
records by mistake when they made the changes. 

Perhaps NSI can follow this trail?

YMMV.
-- 
Rodney Joffe
CenterGate Research Group, LLC.
http://www.centergate.com
"Technology so advanced, even we don't understand it!"(SM)