Domain redirection to an IP address

I'm sorry to hear you're experiencing issues with your domain after creating a certificate. There are a few things we can check to help resolve this:

1. DNS Propagation: DNS changes can take up to 24-48 hours to fully propagate globally. Even though you've waited almost 24 hours, it's possible some DNS servers haven't updated yet. Be patient and give it a bit more time.

2. Name Server Configuration: Double-check that the name servers (NS records) in your domain registrar account exactly match those provided by Route 53 for your hosted zone. This is a critical step that's often overlooked.

3. Record Configuration: Verify that your A record is pointing to the correct IP address of your web server, and that your CNAME records are correctly set up.

4. Security Groups and Firewall: If you're using an EC2 instance, ensure that your security groups allow incoming traffic on port 80 (HTTP) and 443 (HTTPS).

5. Web Server Configuration: Check that your web server is properly configured to handle requests for your domain name.

6. Certificate Impact: Creating a certificate shouldn't directly cause your domain to stop working. However, if you made any changes to your DNS or web server configuration while setting up the certificate, these could have inadvertently caused issues.

To troubleshoot further:

1. Use DNS lookup tools like 'dig' or 'nslookup' to verify that your records are resolving correctly.
2. Try accessing your website using the IP address directly to isolate whether it's a DNS issue or a web server issue.
3. Check your web server's error logs for any relevant information.

If the problem persists after checking these items and waiting for full DNS propagation, you may need to review your overall DNS and web server setup more thoroughly. Consider reaching out to AWS support for more specific guidance tailored to your setup.
Sources
Domain name not resolving | AWS re:Post
A and CNAME records not working? | AWS re:Post

Thank you for your response.
I don't believe I have modified the name servers, but how can I verify and reset them?
Also, before deleting the certificate, the redirection was working correctly, so the server is fine.
By the way, I deleted the certificates because I realized (too late) that I couldn't export them. Andrea

Requesting a certificate cannot and won't cause your site to stop functioning.

I suggest you check first that your domain name registrar has the DNS root servers pointing to the Route 53 hosted zone that you're looking at. Open CloudShell in the AWS management console, install the basic DNS query tools, and make a query for the "NS" records of your domain in the public DNS service. Do that by running these commands and substituting your domain name for example.org:

sudo yum install bind-utils
nslookup -q=NS example.org.

The output should look something like this:

Server:         10.0.0.2
Address:        10.0.0.2#53

Non-authoritative answer:
example.org     nameserver = b.iana-servers.net.
example.org     nameserver = a.iana-servers.net.

Then open your hosted zone in the Route 53 console. Expand the "Hosted zone details" section at the top of the screen and compare the list of "Name servers" listed to the "nameserver" values returned above by nslookup.

If they don't match, then your domain name registrar has pointed your NS records to somewhere other than the correct Route 53 hosted zone, and that needs to be corrected in the domain name registrar's system.

If the NS records do match, then check first if the expected DNS records for your site are in place. You mentioned having added A and CNAME records previously. Does that mean, perhaps, that you added a CNAME record for the "www" name of your domain ("www.example.org"), and it's pointing to some service provider's system outside AWS? And the A record is the same name without the "www." prefix ("example.org"), and it's pointing to the IP address of a web server outside AWS?

If that's correct, then check if both those records are still in place. Also check if there are any CNAME records other than the "www" one and any others with names starting with an underscore "_" in the zone, or if there any NS records in the zone pointing to destinations other than the four name servers that you checked above.

Hi, Thanks for your response. Unfortunately, the issue persists.

When running the command: nslookup -q=NS xbwmonitor.it the returned records match the name servers listed in the hosted zone.

The A record points to the website’s IP address on AWS, and accessing the site directly via IP works correctly. The CNAME record for 'www' points to 'xbwmonitor.it.' There are no other CNAME records, and none that start with "_" The only unusual detail is the SOA record, which has the following value: ns-660.awsdns-18.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

Could this be the cause of the issue?

Best regards, Andrea

When I query the NS records for your domain from one of the root name servers for Italy (the top-level domain "it"), the DNS servers returned don't contain ns-660.awsdns-18.net:

$ nslookup -q=NS xbwmonitor.it. m.dns.it.
Server:         m.dns.it.
Address:        217.29.76.4#53

Non-authoritative answer:
*** Can't find xbwmonitor.it.: No answer

Authoritative answers can be found from:
xbwmonitor.it   nameserver = ns-621.awsdns-13.net.
xbwmonitor.it   nameserver = ns-1897.awsdns-45.co.uk.
xbwmonitor.it   nameserver = ns-497.awsdns-62.com.
xbwmonitor.it   nameserver = ns-1332.awsdns-38.org.

A general query for NS records from AWS's name servers is also failing. The reason is that the "it" top level domain's root name servers are pointing users to the four name servers listed above, and they aren't the ones hosting your public hosted zone, causing queries to fail.

You need to change the NS records in your public hosted zone to match those shown in the console under "Hosted zone details". Also, you have to set your domain name registrar (from which you acquired the .it domain name) to point your domain to the four name servers listed in Hosted zone details and not the four listed above.

It may take several hours for all the caches around the country and world to reflect the corrections. All users still making queries to the no-longer-existing hosted zone on the old name servers will continue to fail to get proper responses.

Thank you for your reply.

Unfortunately after 10 hours, it still doesn’t work.

I have copied the NS records shown in the console under "Hosted Zone Details" into the NS record in my public hosted zone (they were different).
My web app, which I need to access, is on AWS. I don’t understand when you say:
"Also, you have to set your domain name registrar (from which you acquired the .it domain name) to point your domain...." Where do I do this?

Thanks again,
Andrea

This is how I have set the NS record, but when running I see other domains...

nslookup -q=NS xbwmonitor.it. m.dns.it. Server: m.dns.it. Address: 217.29.76.4#53

Non-authoritative answer: *** Can't find xbwmonitor.it.: No answer

Authoritative answers can be found from: xbwmonitor.it nameserver = ns-1332.awsdns-38.org. xbwmonitor.it nameserver = ns-621.awsdns-13.net. xbwmonitor.it nameserver = ns-497.awsdns-62.com. xbwmonitor.it nameserver = ns-1897.awsdns-45.co.uk.

Thanks

You can see the registration details for your domain at the website of Registro .it, which is the organisation that manages the .it top level domain. The search form is at http://web-whois.nic.it/

It shows that you've registered the domain through a provider called Gandi, a French company that provides domain name registration services, i.e., is a domain name registrar. The data at Registro .it also shows that the name servers configured for your domain at Gandi are:

• ns-497.awsdns-62.com
• ns-621.awsdns-13.net
• ns-1332.awsdns-38.org
• ns-1897.awsdns-45.co.uk

and not the correct ones shown in your screenshot. This is why name resolution is failing: all the world is told to send queries for your domain to the four name servers above, which don't serve your zone, instead of the four name servers shown in your screenshot that would serve it.

You or perhaps one of your colleagues will need to log in to Gandi's site at https://www.gandi.net and replace the incorrect four name servers above with the four correct name servers shown in the Hosted zone details in the Route 53 console. It will take many hours for the change to propagate across the internet, and the domain will first start to work intermittently for some users but not others. I don't know how long the TTL (time to live) values are for the .it root, but usually it'll take 12-24 hours for the changes to propagate across the world.

Thank you for your reply.

But I registered my domain on AWS, not with Gandi.net. How can I see my domain here? I tried, but I can't see my domains.

Andrea

There are two parts to a domain name service. One is registering the domain with a domain name registrar. This part represents the legal and contractual entitlement to use the domain name. The second part is the technical DNS name service, which in your case is provided by AWS in the form of a public hosted zone.

The domain name registrar that handles the first part controls which name servers the world is pointed to for your domain name for the second part.

If you indeed registered your domain via Amazon Route 53 and they're using Gandi as their subcontractor, you should find your domain under "Registered domains" in the Route 53 console. Open the domain details and choose "Edit name servers" to change the list of name servers to the four shown in Hosted zone details discussed earlier.

Thank you for your reply. I have reported the names of the returning servers from http://web-whois.nic.it/ with my domain name, and now they appear on Route53:

ns-497.awsdns-62.com. ns-621.awsdns-13.net. ns-1332.awsdns-38.org. ns-1897.awsdns-45.co.uk.

Now I’m waiting..

Thanks Andrea

Perfect, now the domain is working. I just need to enable HTTPS.
Thank you so much, Andrea.