1.1.1.1 intermittently not resolving nu.nl

Zero Trust 1.1.1.1
1

Hi,

I notice that since 2020-04-13 the 1.1.1.1 service intermittently doesn’t resolve nu.nl (a leading Dutch news site, very robust infra set-up), which resolves correctly via e.g. 8.8.8.8 or via the authorative servers.

For example see below, first query fails, second one succeeds. It continues like that every time I try, where the failure rate is ~80%:

nash% dig @1.1.1.1 nu.nl

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> @1.1.1.1 nu.nl
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 32562
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;nu.nl. IN A

;; Query time: 1153 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Tue Apr 14 11:39:46 CEST 2020
;; MSG SIZE rcvd: 34

nash% dig @1.1.1.1 nu.nl

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> @1.1.1.1 nu.nl
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30870
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;nu.nl. IN A

;; ANSWER SECTION:
nu.nl. 48 IN A 52.84.136.38
nu.nl. 48 IN A 52.84.136.109
nu.nl. 48 IN A 52.84.136.112
nu.nl. 48 IN A 52.84.136.115

;; Query time: 7 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Tue Apr 14 11:39:47 CEST 2020
;; MSG SIZE rcvd: 98

Other domains resolve fine all the time, I only spotted the issue with nu.nl.

Anyone any idea?

Regards,

  • Jan Joris -
2

Same problem here.

C:>nslookup nu.nl 1.1.1.1
Server: one.one.one.one
Address: 1.1.1.1

*** one.one.one.one can’t find nu.nl: Server failed

C:>nslookup nu.nl 1.0.0.1
Server: one.one.one.one
Address: 1.0.0.1

*** one.one.one.one can’t find nu.nl: Server failed

C:>nslookup nu.nl 8.8.8.8
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: nu.nl
Addresses: 52.84.136.115
52.84.136.109
52.84.136.38
52.84.136.112

C:>nslookup -class=chaos -type=txt id.server 1.1.1.1
Server: one.one.one.one
Address: 1.1.1.1

Non-authoritative answer:
id.server text =

    "AMS"

C:>nslookup -class=chaos -type=txt id.server 1.0.0.1
Server: one.one.one.one
Address: 1.0.0.1

Non-authoritative answer:
id.server text =

    "AMS"
3

Hi,

Good day.
I’m just thinking on the network side of things, depending on where you are trying to do the query (corporate or external network), could there be a possible routing issue to 1.1.1.1?

This can be possibly check during the time when you’re not able to resolve nu.nl via 1.1.1.1 by doing a traceroute to 1.1.1.1 at the same time.

You could also do a DNS query trace by running this command >> dig +trace @1.1.1.1 nu.nl

Hope this helps.

4

No, that cannot be it. Resolution of any other domain I tried works flawlessly, it’s really that one domain that doesn’t resolve correctly.

5

Looks like the issue has been fixed shortly after I posted it here!