Adress not resolved by DNS

Zero Trust 1.1.1.1
1

Hello community

i have some problems today with Cloudflare DNS (yesterday it’s working)
he can t resolve https://welcome.oda.sas.com and many url with this domain

if I use provider’s DNS or 88xx it’s works
I use it from France

any help ?
Regards

2

Hi There,
I looked up the A record for welcome.oda.sas.com. On 88xx is an A record. On Cloudflare’s DNS are none. Cloudflare is not the Authority for this domain.

I did a little check and as I can tell the server (glb.sas.com) is not responding to UDP queries.
https://dnsviz.net/d/welcome.oda.sas.com/dnssec/

eventually Cloudflare cant query the Records from them. That would at least explain why the Cloudflare DNS has no Records.

1 Like
3

No, welcome.oda.sas.com. is a CNAME of welcome.glb.sas.com., all servers are responsive and welcome.glb.sas.com. also resolves on 1.1.1.1. This is a problem of Cloudflare and not their nameserver. Previously there were more domains not resolving on Cloudflare and it was almost always a problem with either DNSSEC, a CNAME record, or both. I think this is the case again here. The only thing I noticed is that extdns0[1-6].na.sas.com. answers with an authority section and not answer section when requesting NS records for glb.sas.com., however, this should not be a problem.

1.1.1.1’s answer:

~> dig a welcome.oda.sas.com. @1.1.1.1
; <<>> DiG 9.16.25 <<>> a welcome.oda.sas.com. @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53536
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 10 (RRSIGs Missing): (failed to verify welcome.oda.sas.com. CNAME)
;; QUESTION SECTION:
;welcome.oda.sas.com.		IN	A

;; Query time: 600 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Wed Jan 19 22:29:13 CET 2022
;; MSG SIZE  rcvd: 97

Let’s try the query ourselves:

~> dig ns sas.com. +short
extdns01.na.sas.com.
extdns05.na.sas.com.
extdns04.na.sas.com.
extdns06.na.sas.com.
extdns03.na.sas.com.
extdns02.na.sas.com.

~> dig ns oda.sas.com. @extdns01.na.sas.com. +short
dns1cxxRb321nc0.net.sas.com.
extdns05.na.sas.com.
extdns02.na.sas.com.
extdns03.na.sas.com.
extdns04.na.sas.com.
extdns06.na.sas.com.
extdns01.na.sas.com.

~> dig a welcome.oda.sas.com. @extdns01.na.sas.com. +short
welcome.glb.sas.com.

~> dig ns glb.sas.com. @extdns01.na.sas.com.
...
;; AUTHORITY SECTION:
glb.sas.com.		86400	IN	NS	l13e149dac05nc0.net.sas.com.
glb.sas.com.		86400	IN	NS	l13e149rcm36nc0.net.sas.com.
glb.sas.com.		86400	IN	NS	l03EXTxa102tx17.net.sas.com.
...

~> dig a welcome.glb.sas.com. @l13e149dac05nc0.net.sas.com. +short
108.128.227.35

And we get the same result as Google:

~> dig a welcome.oda.sas.com. @8.8.8.8 +short                             
welcome.glb.sas.com.
108.128.227.35

Interestingly, welcome.glb.sas.com., where the CNAME is pointing to, is not a problem for Cloudflare:

~> dig a welcome.glb.sas.com. @1.1.1.1 +short
108.128.227.35

So this has to be a problem with Cloudflare resolving welcome.oda.sas.com. to welcome.glb.sas.com..

1 Like
4

Hello All

today it s working
many thanks all

5

Still doesn’t seem to resolve for me :thinking:

6

I think it is the same issue as Some VMware subdomains not reachable - #14 by mvavrusa

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.