Your domain is not configured correctly, you have a DNSSEC problem, so the problem is not on the recursive resolver you use, no matter which, but on the domain itself, and you need to fix it.
See DNSViz analysis at https://dnsviz.net/d/ironpawsllc.com/YfurFA/dnssec/ (you have 9 errors to fix)
but it is also easy to prove by using any validating resolver and comparing the answer with the default "DNSSEC validation" enabled and then explicitely disabling it:
$ dig @9.9.9.9 ironpawsllc.com NS
; <<>> DiG 9.16.25 <<>> @9.9.9.9 ironpawsllc.com NS
; (1 server found)
;; global options: +cmd
;; Sending:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58418
;; flags: rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 5c89ab72fd28093b
;; QUESTION SECTION:
;ironpawsllc.com. IN NS
;; QUERY SIZE: 56
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 58418
SERVFAIL can be many things but is also the case for any DNSSEC problem, and if disabling DNSSEC validation (the +cd flag):
$ dig @9.9.9.9 ironpawsllc.com NS +cd
; <<>> DiG 9.16.25 <<>> @9.9.9.9 ironpawsllc.com NS +cd
; (1 server found)
;; global options: +cmd
;; Sending:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2142
;; flags: rd ad cd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 4c56f2c5e1caa672
;; QUESTION SECTION:
;ironpawsllc.com. IN NS
;; QUERY SIZE: 56
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2142
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; EDE: 9 (DNSKEY Missing)
;; QUESTION SECTION:
;ironpawsllc.com. IN NS
;; ANSWER SECTION:
ironpawsllc.com. 1h IN NS ns1.ironpawsllc.com.
ironpawsllc.com. 1h IN NS ns2.ironpawsllc.com.
;; Query time: 366 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Thu Feb 03 11:17:07 CET 2022
;; MSG SIZE rcvd: 86
The fact that for the same query on the same validating resolver works with +cd (checking disabled) but doesn't work without it, is a sign at 99.99% level of probability that DNSSEC is broken on the domain, and this is nicely shown and explained on above DNSViz page, for which I attach the resulting graph here:
NB: you even get above in dig output an "EDE" for Extended DNS Error, a recent addition in DNS land not yet supported by all nameservers, but here it tells you of a DNSSEC problem immediately: EDE: 9 (DNSKEY Missing)
As for
I am still new to server administration, any insights are appreciated.
If you are new to DNS and specially to DNS troubleshooting, it is better to stay away from DNSSEC completely, or let some external provider handle your DNS completely without you having to do anything. Here and now you have either to remove DNSSEC completely, or set up proper keys and digests. In both cases you need to go through your registrar to remove/update DS data that the registry will then later publish. Your DNS provider should help you with that.
