Strange DNS issue with .pro domains

[flyingL123]

During the day, on my home wifi network, when I run `dig pro` from terminal, I get the expected response:

% dig pro

; <<>> DiG 9.10.6 <<>> pro
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49821
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pro. IN A

;; AUTHORITY SECTION:
pro. 3103 IN SOA a0.pro.afilias-nst.info. hostmaster.donuts.email. 1744428469 7200 900 1209600 3600

;; Query time: 10 msec
;; SERVER: 71.250.0.12#53(71.250.0.12)
;; WHEN: Fri Apr 11 11:47:06 EDT 2025
;; MSG SIZE rcvd: 114

I run the command over and over again at all different times of day, and confirm it responds without issue. Then, around 7pm Eastern Time, when I run `dig pro` on my home wifi network, I begin to get `SERVFAIL` as a response.

% dig pro

; <<>> DiG 9.10.6 <<>> pro
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 40501
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; OPT=15: 00 16 ("..")
;; QUESTION SECTION:
;pro. IN A

;; Query time: 13 msec
;; SERVER: 71.250.0.12#53(71.250.0.12)
;; WHEN: Fri Apr 11 23:43:02 EDT 2025
;; MSG SIZE rcvd: 38

This continues pretty consistently. Once in a while a valid response is returned, but 90% of the time, it's `SERVFAIL`.

When the `SERVFAIL` responses are occurring, if I run the same command specifying to use `1.1.1.1` as a nameserver, the command works perfectly every time:

% dig @1.1.1.1 pro

; <<>> DiG 9.10.6 <<>> @1.1.1.1 pro
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62747
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;pro. IN A

;; AUTHORITY SECTION:
pro. 3600 IN SOA a0.pro.afilias-nst.info. hostmaster.donuts.email. 1744429095 7200 900 1209600 3600

;; Query time: 19 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Apr 11 23:50:53 EDT 2025
;; MSG SIZE rcvd: 114

The next morning, the `SERVFAIL` responses stop, and the valid responses return again.

This leads me to believe that the issue is being caused by Verizon Fios because the default command is using their nameservers (`71.250.0.12`), and when I specify using `1.1.1.1` the issue goes away.

Also, while the issue is occurring, if I disconnect from wifi and instead use the cellular network, that works properly, and as you can see, a different nameserver is used for the query:

% dig pro

; <<>> DiG 9.10.6 <<>> pro
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60675
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pro. IN A

;; AUTHORITY SECTION:
pro. 3600 IN SOA a0.pro.afilias-nst.info. hostmaster.donuts.email. 1744429729 7200 900 1209600 3600

;; Query time: 109 msec
;; SERVER: fe80::c81f:e8ff:fe30:6264%14#53(fe80::c81f:e8ff:fe30:6264%14)
;; WHEN: Sat Apr 12 00:01:25 EDT 2025
;; MSG SIZE rcvd: 114

Additionally, while the issue is occurring, other domains work fine. For example `dig com` works, `dig google.com` works, `dig me` works, `dig co` works, etc. It seems like there is some issue with Fios and the `.pro` TLD.

What is happening here? How do I even begin to solve this problem?

Please note, this is coming up because I have found that my website, which is a `.pro` domain, becomes inaccessible from a browser around 7pm every night. For example, when I try to navigate to `sitechecker.pro`, I receive `DNS_PROBE_FINISHED_NXDOMAIN ` browser errors. I mention this because simply changing the nameservers that my home wifi uses is not the solution I'm looking for. I am trying to track down the underlying issue so I can try to get it resolved.

[careqb]

I have been having the same issue for a month or so now with my .pro website, it's been driving me insane. This also occurs on Comcast DNS resolvers (75.75.75.75 and 75.75.76.76). Similarly goes away instantly if I change the DNS resolver on my local wifi.

Perhaps we can investigate together, but I'm considering just buying a new domain...

[smith6612 · Accepted solution]

Could it be an intermittent issue with DNSSEC perhaps? A lot of ISP DNS Servers don't validate DNSSEC and other DNS Extensions properly.

What does https://dnsviz.net/ show for your domain during the problem, and outside of the problem? Any notable differences? This should help isolate the problem down further.

Also, Verizon operates "clean" RFC-compliant DNS Servers with the IP address ending in .14. If your server is 71.250.0.12, then change it to 71.250.0.14. Try checking against those, as sometimes these search redirection / un-clean servers have other undesired behaviors.