[Question] Need help with configuration - Domain doesn't point to the correct IP from outside the server

[mdPlusPlus]

First of all sorry for abusing the GitHub issues as a support board, but it's hard to find helpful ressources for this project elsewhere.

Let's assume the following values for better understanding the issue:

• VPS with IP 100.100.100.100 and domain domain.com
• Docker command on that server: # docker run -d -v /root/ddns/:/var/cache/bind/ -p 127.0.0.1:5353:8080 -p 53:53/udp -e SHARED_SECRET=changeme -e ZONE=domain.com -e RECORD_TTL=3600 --name=ddns davd/docker-ddns
• Nginx reverse proxy pointing https://ddns.domain.com to 127.0.0.1:5353
• Domain that should point to the dynamic IP: https://server.domain.com
• Update URL: https://ddns.domain.com/update?secret=changeme&domain=server&addr=1.2.3.4
• I added two entries to my DNS records in the hoster interface of domain.com (of which I honestly don't even know whether they are necessary, DNS is witchcraft to me):
  • * A 100.100.100.100
  • @ A 100.100.100.100
  • dyndns NS ns
  • ns A 100.100.100.100
• By visiting the update URL I told docker-ddns to set the domain server.domain.com to 1.2.3.4, which results in a success message. docker logs -f ddns confirms this (2020/07/18 19:01:15 A record update request: server -> 1.2.3.4)

Now to the actual issue:
Using dig on the server hosting docker-ddns (100.100.100.100) is giving me the correct DNS entry:

# dig @127.0.0.1 +short server.domain.com
1.2.3.4
# dig @100.100.100.100 +short server.domain.com
1.2.3.4

However when quering from another machine it alway returns 100.100.100.100 instead of 1.2.3.4

$ dig @100.100.100.100 +short server.domain.com
100.100.100.100

Using my default DNS server results in the same thing:

$ dig +short server.domain.com
100.100.100.100

It's been more than 24h since I changed my DNS records, so I don't think it is a propagation issue, especially because it still returns 100.100.100.100 when queried directly (dig @100.100.100.100).

What am I doing wrong?

Edit: Redacted/modified screenshot of my hoster's interface for the DNS records (forgive my mad photoshop skillz):

[tkwant]

Hello do you solved this problem? I have the same problem

[seriousm4x]

Same setup and problem here. I cant figure out why. You guys got any luck?

[JEK58]

Same problem here. We're probably missing something…

[mdPlusPlus]

Hey, I've just come to say that this works perfectly well on another domain host. I have no idea why, but I couldn't get it to work with my domain and server from https://netcup.de.
Today I spun up a server at https://sporestack.com and a domain from https://uniregistry.com and everything worked perfectly.

[mdPlusPlus]

Just for reference, this is my complete DNS setting:

And this is how I start the DynDNS:

docker run -it -d \
    -p 127.0.0.1:8080:8080 \
    -p 53:53 \
    -p 53:53/udp \
    -e RECORD_TTL=3600 \
    -e SHARED_SECRET=xxxxx \
    -e ZONE=dyn.domain.com \
    -v /path/to/dyn.domain.com_data:/var/cache/bind \
    --name=dyn_domain_com \
    --restart=unless-stopped \
    davd/docker-ddns:latest

Clients are available as home.dyn.domain.com, brother.dyn.domain.com, sister.dyn.domain.com or whatever you choose.

I also put a NGINX https reverse proxy in front of it, so I won't leak my secret:

server {
    server_name dns.domain.com
    server_tokens off;

    listen 80;
    listen [::]:80;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    server_name dns.domain.com
    server_tokens off;

    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    location / {
        proxy_pass http://127.0.0.1:8080;
    }

    ssl_certificate     /etc/letsencrypt/live/dns.domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dns.domain.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /etc/letsencrypt/live/dns.domain.com/chain.pem;

    # replace with the IP address of your resolver
    resolver 1.1.1.1;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    access_log  /var/log/nginx/dns.domain.com-access.log;
    error_log   /var/log/nginx/dns.domain.com-error.log;
}

Edit: After close inspection I might have chosen the zone wrong when I first tried it (in the OP). I'm not sure if I really chose server.domain.com or server.dyndns.domain.com and just omitted that part for the example. Having set the zone incorrectly would explain why the entry didn't propagate to external DNS servers, though.