DNS proxy fails with 521 error - while working for other domain

[user51521]

What is the name of the domain?

redacted

What is the error number?

521

What is the issue you’re encountering

Unable to connect to web server

What feature, service or problem is this related to?

DNS records

What are the steps to reproduce the issue?

I have two domains:
image.example1[.]com
image.example2[.]com

Both point to the same reverse proxy (caddy on firewall).

image.example1[.]com - works totally fine.
image.example2[.]com - results in 521 connect error. Disabling CF proxy results also in server connect error.

In Security Analytics I can see some incoming requests (see screenshots) but no successful connect.

If I test it from my internal network, setting up a local DNS resolver pointing image.example2[.]com to the internal interface of my FW, it works totally fine.

So the firewall accepts the requests for this hostname / domain. Internally it works. Resolving externally via CF fails.

Does anyone has any idea why this is? Why does the same setup work for example1 domain but not for example2 domain?

Any input is highly appreciated!

Tom

Screenshot of the error

[user51521]

I did some further testing. Manually accessing the firewall with the hostname works:
curl -k --resolve image.example[.]my:443:123.123.123.123 image.example[.]my

Hostname and DNS in CF are also correct.

But when I access the URL with this hostname via browser and CF, there is also a 521 error

[fritex]

@user51521

Disabling CF proxy results also in server connect error.

I am afraid you’d have to cross-check this with your service/hosting provider if the error persists even when Cloudflare is paused.

@user51521

Why does the same setup work for example1 domain but not for example2 domain?

My best guess, misconfiguration with web server vhost files

Troubleshooting steps:

1. Ensure DNS records for image.example2.com are correct at DNS tab of Cloudflare dashboard.
2. Compare the setup of image.example1.com and image.example2.com on the web server.

@user51521

firewall

Might be one domain is allowed, other filtered?