I updated the nameservers of my domain, but it's not working

When you change the nameservers of your GA.NU domain (for example, example.ga.nu), the parent zone (ga.nu) updates its delegation records to point at your new DNS provider. If your domain still doesn’t resolve after you update the nameservers, use this guide to understand why and how to fix it.

Quick answer

• Changes to nameservers are published quickly on GA.NU, but resolvers around the internet may cache old data for up to 24–48 hours.
• The new nameservers must be correctly configured to serve your domain authoritatively. If they’re not ready, your domain can stop resolving immediately after the change.

How delegation works for .ga.nu subdomains

• Your domain (e.g., cafe.ga.nu) is a subdomain of ga.nu.
• GA.NU sets NS records at ga.nu that delegate cafe.ga.nu to the nameservers you specify (e.g., ns1.yourdns.net, ns2.yourdns.net).
• Resolvers cache these delegation records. Until caches expire, some users may still reach the old nameservers.
• If your chosen nameservers are inside the domain itself (e.g., ns1.cafe.ga.nu), you must also create “glue” (child host) records with IP addresses at GA.NU so resolvers can find them.

Common reasons it’s “not working”

1. Cache/propagation delay

   • Resolvers may still be using the old delegation until TTLs expire.

2. Misspelled or incorrect nameserver hostnames

   • Nameservers must be fully-qualified hostnames (e.g., ns1.provider.com). Do not enter IP addresses in the nameserver fields.

3. Nameservers not authoritative for your domain yet

   • Your DNS provider must have a zone for yourdomain.ga.nu ready before you switch nameservers.
   • The nameservers should answer with an SOA/NS for your domain.

4. Missing glue (child host) records for in-domain nameservers

   • If you set nameservers like ns1.yourdomain.ga.nu, you must add child host records at GA.NU with the IPs for ns1.yourdomain.ga.nu, ns2.yourdomain.ga.nu, etc.

5. DNSSEC mismatch (bogus validation)

   • If DNSSEC (DS records) is enabled at GA.NU but your new DNS provider is not serving matching DNSSEC keys, resolvers will reject answers.
   • Either update DS to match the new provider’s DNSSEC or temporarily disable DNSSEC before switching.

6. Only one nameserver or unreachable nameservers

   • Use at least two independent nameservers on separate networks for resilience.
   • Ensure port 53 (UDP and TCP) is reachable and not firewalled.

Before you change nameservers: a safe rollout plan

1. Create the zone at your new DNS provider.
2. Verify the zone answers authoritatively on all new nameservers.
3. If using in-domain nameservers (vanity nameservers), add child host records and confirm glue resolves.
4. If using DNSSEC, obtain DS records from your provider and plan to update them immediately after the switch.
5. Then update nameservers in the GA.NU dashboard.

How to test what’s wrong

1) Check the current delegation seen by public resolvers

dig +short NS cafe.ga.nu

• Returns the nameservers resolvers currently use. If you still see the old nameservers, caches haven’t updated yet.

2) Trace the delegation path

dig +trace cafe.ga.nu

• Shows which parent/child servers are being used and where lookups may be failing.

3) Confirm the new nameservers are authoritative

dig @ns1.yourdns.net cafe.ga.nu SOA

• Expected: an SOA record for cafe.ga.nu with ns1.yourdns.net answering authoritatively (AA flag set).
• If you get NXDOMAIN, SERVFAIL, or a different zone’s SOA, the new DNS is not correctly set up.

4) Validate glue for in-domain nameservers

If you set ns1.cafe.ga.nu as a nameserver, check that it has an IP (glue):

dig +short ns1.cafe.ga.nu A
dig +short ns1.cafe.ga.nu AAAA

• Expected: public IP addresses. If empty, add child host (glue) records at GA.NU.

5) Check DNSSEC status

dig +dnssec cafe.ga.nu A
dig +short DS cafe.ga.nu

• If a DS exists at the parent but the new nameservers don’t serve matching DNSSEC, many resolvers will return SERVFAIL.

6) Try different resolvers and clear local cache

• Use a different resolver: dig @1.1.1.1 cafe.ga.nu A or dig @8.8.8.8 cafe.ga.nu A.
• Clear local cache: on Windows ipconfig /flushdns; on macOS sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder.

Fixes by scenario

• Propagation delay

  • Wait up to 24–48 hours for global caches to expire. You can often see the change sooner by using different resolvers.

• Nameserver typo or wrong format

  • Edit the nameserver list in GA.NU to the exact hostnames provided by your DNS provider.

• New nameservers not serving your zone

  • Log in to your DNS provider and create yourdomain.ga.nu with necessary records (A/AAAA, MX, CNAME, etc.).
  • Retest authoritativeness with dig @nsX provider SOA yourdomain.ga.nu.

• Missing glue for in-domain nameservers

  • In the GA.NU dashboard, add child host entries (sometimes called “hostnames” or “private nameservers”) for ns1.yourdomain.ga.nu, ns2.yourdomain.ga.nu with their IPv4/IPv6 addresses.
  • After saving, verify the glue resolves, then set those nameservers.

• DNSSEC validation failures

  • Option A: Disable DNSSEC at GA.NU temporarily, then re-enable once your provider supplies DS records.
  • Option B: Update DS at GA.NU to exactly match the new provider’s key material (algorithm, key tag, digest).
  • Retest with dig +dnssec to confirm no SERVFAIL.

• Unreachable nameservers

  • Ensure firewalls allow DNS (UDP and TCP port 53).
  • Check provider status pages for outages and confirm multiple nameservers are configured.

Practical example: moving to a new provider

1. Your domain: cafe.ga.nu
2. New provider gives: ns1.yourdns.net, ns2.yourdns.net
3. At the new provider, create zone cafe.ga.nu and add records (e.g., A @ 203.0.113.10, MX mail.yourdns.net).
4. Verify:

   dig @ns1.yourdns.net cafe.ga.nu SOA
   dig @ns1.yourdns.net cafe.ga.nu A
   

5. In GA.NU, update nameservers to ns1.yourdns.net and ns2.yourdns.net.
6. Optional: If the provider supports DNSSEC, add DS records at GA.NU.
7. Test:

   dig +trace cafe.ga.nu
   dig +short NS cafe.ga.nu
   dig cafe.ga.nu A
   

8. If some users still see the old site, wait for caches to expire or ask them to try a different resolver.

Tips

• Keep at least two nameservers on different networks.
• Don’t switch nameservers until the new provider’s zone is ready.
• If you use vanity nameservers (e.g., ns1.yourdomain.ga.nu), set glue first.
• Plan DNSSEC changes carefully; mismatched DS records will break resolution.

Need help?

If you’ve checked the steps above and your domain still doesn’t resolve, contact GA.NU support with:

• Your domain name.
• The nameservers you set.
• Output from dig +trace yourdomain.ga.nu and dig @ns1 newprovider SOA yourdomain.ga.nu.

We’ll help diagnose the delegation and get you back online.