Bank domain does not resolve

We have a local bank which is at bellco dot org. It doesn’t resolve on 1.1.1.1, but resolves on others. Searching other issues indicated it might be a DNSSEC misconfiguration. However, I check it at verisignlabs dnssec-analyzer and there seem to be no problems.

Any thoughts on why it does not show up in Cloudflared DNS, and what I could tell the company to fix?

Works on my end using 1.1.1.1 DNS :thinking:

DNSSEC is enabled and fine so far.

Interesting. When I do it from the command line, it doesn’t work:

[email protected]:~$ nslookup bellco.org 1.1.1.1
Server:         1.1.1.1
Address:        1.1.1.1#53

** server can't find bellco.org: SERVFAIL

[email protected]:~$ nslookup bellco.org 8.8.8.8
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   bellco.org
Address: 23.185.0.3
Name:   bellco.org
Address: 2620:12a:8000::3
Name:   bellco.org
Address: 2620:12a:8001::3

I wonder if the local ISP is maybe blocking something, or if there’s something on the network :thinking:

From my end:

$ nslookup bellco.org 1.1.1.1
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
Name:   bellco.org
Address: 23.185.0.3
Name:   bellco.org
Address: 2620:12a:8000::3
Name:   bellco.org
Address: 2620:12a:8001::3

dig trace is also ok.

Or wait a bit, maybe not so :confused:

Testing online, Cloudflare failed to respond? :thinking:

1 Like

Yes, I’m getting the same failure with dig on 1.1.1.1, but working on 8.8.8.8:

[email protected]:~$ dig @1.1.1.1 bellco.org

; <<>> DiG 9.18.1-1ubuntu1.1-Ubuntu <<>> @1.1.1.1 bellco.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 29888
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for open-techs.com.)
;; QUESTION SECTION:
;bellco.org.                    IN      A

;; Query time: 2215 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Thu Sep 15 14:33:20 MDT 2022
;; MSG SIZE  rcvd: 93

[email protected]:~$ dig @8.8.8.8 bellco.org

; <<>> DiG 9.18.1-1ubuntu1.1-Ubuntu <<>> @8.8.8.8 bellco.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11429
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;bellco.org.                    IN      A

;; ANSWER SECTION:
bellco.org.             454     IN      A       23.185.0.3

;; Query time: 19 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Thu Sep 15 14:33:37 MDT 2022
;; MSG SIZE  rcvd: 55

Thanks for the site, I’m seeing those results that Cloudflare isn’t returning anything for this domain:

Works also fine for me:

dig @1.1.1.1 bellco.org

; <<>> DiG 9.16.27 <<>> @1.1.1.1 bellco.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42371
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;bellco.org.                    IN      A

;; ANSWER SECTION:
bellco.org.             896     IN      A       23.185.0.3

;; Query time: 28 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Thu Sep 15 23:20:33 CEST 2022
;; MSG SIZE  rcvd: 55

Have you tried restarting your computer? If it still doesn’t work, would you mind changing your DNS servers to 162.159.36.1 and 162.159.46.1, and try again?

Hope it helps!

Thanks, I tried, and it seems to be complaining about a missing DNSKEY on the domain:

[email protected]:~$ dig @162.159.36.1 bellco.org

; <<>> DiG 9.18.1-1ubuntu1.1-Ubuntu <<>> @162.159.36.1 bellco.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54584
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for open-techs.com.)
;; QUESTION SECTION:
;bellco.org.                    IN      A

;; Query time: 1795 msec
;; SERVER: 162.159.36.1#53(162.159.36.1) (UDP)
;; WHEN: Thu Sep 15 15:28:38 MDT 2022
;; MSG SIZE  rcvd: 93

But then not everyone is getting it :confused:

I’ve run a test on a different website, and it showed some warnings and errors complaining, mainly, about DNSSEC.

https://dnsviz.net/d/bellco.org/dnssec/

Hope it helps!

2 Likes

Old algorithm 7 being used, which …

Ye, a bit weird :confused:

1 Like

Thanks @fritex and @Lumito ! I’ve taken the information you’ve found and sent it to the bank. Hopefully their web team can address it.

1 Like