Multiple queries to cname record without IPv6

[Nuno]

Hi,

I have a root domain pointing to a cname record without IPv6 ( example.com → cname.otherdomain.com ) but in the otherdomain.com DNS logs I have and huge amount of IPv6 queries, like 6x plus IPv4 ones.

I understand thet one per protocol is usual, but not this difference.

What could be causing this?

Thanks

[fritex]

Greetings,

Thank you for asking.

May I ask if those IPs in your server log files are coming from the Cloudflare network?

Maybe Cloudflare tried to connect to your origin but didn’t succeed

Kindly re-check if Cloudflare is allowed to connect to your origin host to as follows in the below article:

• https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses

Nevertheless, Cloudflare IP addresses list can be found here:

• https://www.cloudflare.com/ips/

Otherwise, maybe some kind of an attack pattern is ongoing in your case?

If you see Cloudflare IPs, kindly make sure to implement the method to restore the real visitor IP in your server log files by following the steps from the article below:

• https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs

Also, might be Cloudflare gives IPv6 precedence over IPv4 when connecting or something with the “IP translation”

[Nuno]

Hi,

Yes, all IPs are from CF, queries are mainly from 172.70.173.0.

Thanks