My domain as disappeared from CF DNS (and only CF)

[user18460]

I’m not a Cloudflare customer, but my domain is suddenly not resolvable through 1.1.1.1, causing me a massive outage as CF moves so much DNS traffic. All other major DNS providers see me fine. There’s no phone number to call for support and if you’re not an existing customer, emails to support are summarily rejected. So I created a free account and then emailed support again. It was rejected a little slower, directing me to free community forum support. Apparently, if I wait 72 hours through this outage, then I can escalate it to the More Help tag. This is unbelievably frustrating. Can someone from the CF DNS team please pick this up early? I’m at a total loss of what to do next. nuscalepower.com

[fritex]

Did you recently moved your domain away from Cloudflare Registrar or Cloudflare nameservers?

True, I do not get IP over 1.1.1.1, but using other DNS’s work - tested using online tool here:

• Dig web interface - online dns lookup tool

May I suggest flushing the DNS for specified record using below tool:

• 1.1.1.1 — the Internet’s Fastest, Privacy-First DNS Resolver

DNSSEC is a bit broken? (looks fine from here, but there are some warnings which might have an impact?):

SSL certificate is ok, valid.

WHOIS domain status is mixed:
clientTransferProhibited, serverDeleteProhibited, serverTransferProhibited, serverUpdateProhibited

@sdayman there was lately a similar topic about serverTransferprohibited status code as I remember?

Domain treated as not registered although it is

I wonder if this status of your domain is causing the problem: https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en#serverTransferProhibited

Cloudflare dns is not propogating properly even after 2 days

They seem to be missing the point, which is common with GoDaddy support. It’s the ones where it’s not a Cloudflare name server that’s the problem. It could just take a little more time, but while you’re waiting, maybe you can check with their registrar team because the domain has several notifications that may be a concern: Domain Status: clientDeleteProhibited EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN Domain Status: clientRenewProhibited https://icann.org/epp#clie…

I get DNS_PROBE_FINISHED_NXDOMAIN. Kindly, may I suggest looking into below article for more information about why this error happens and how to trobleshoot:

Community Tip - Fixing the DNS PROBE FINISHED NXDOMAIN error

Error Try the suggestions in this Community Tip to help you fix DNS_PROBE_FINISHED_NXDOMAIN. Background NXDOMAIN stands for non-existent domain. When a domain cannot be resolved it is an issue with the DNS servers or the domain name is newly registered or not yet registered at all. NXDOMAIN can also take place due to network or DNS server problems. A response other than a valid IP address (e.g., timeout, SERVFAIL, NXDOMAIN or NOERROR) most likely points to the origin as the source of your iss…

Not sure if it’s related to some recent incident which can be checked on a Cloudflare Status page using below link:

• https://www.cloudflarestatus.com/

[sdayman]

@mvavrusa is the DNS expert on staff and can probably track down why 1.1.1.1 can’t resolve that domain. It’s after hours right now, and I don’t know anybody else who’s on shift right now who looks after 1.1.1.1

[user18460]

@fritex No, I haven’t been a CF customer for about 6 or 7 years. I moved away from CF when their staff caused a major outage with my CF registrar service and the one (1) guy who could fix it went home for the day. That made me deeply concerned about the support staffing levels, so I moved my business away years ago. I haven’t had my domain on CF for a very long time, so I’m baffled by what’s happening now.
BTW, thanks for the suggestions. I really appreciate your willingness to provide some pointers.

[sdayman]

@fritex

there was lately a similar topic about serverTransferprohibited status code as I remember?

Granted, domain registration status like that would be a cause for concern, but I’m never sure how those affect real world behavior. I’d certainly recommend contacting the registrar to make sure everything is all clear and if they could get rid of the worst of those status messages. Especially these:
https://icann.org/epp#serverUpdateProhibited
https://icann.org/epp#serverTransferProhibited

[user18460]

@sdayman These have been set like these for years as part of a “domain lock” security feature by the registrar, CSC. You can compare nuscale.com (working) and nuscalepower.com (not working) for DNSSEC and WHOIS.

[mvavrusa]

Hi! Sorry about the issues. I disabled DNSSEC validation for this zone temporarily so it should resolve now. It doesn’t work because there are two DS records for the zone:

nuscalepower.com.   	86400	IN	DS	64807 8 2 60E153C0E318759C7AC69F4EF48F4E641D39031D4D9C91413AF922A76A140ABE
nuscalepower.com.   	86400	IN	DS	5779 8 2 28E09A06D733F5EFB5057ADE84AF4F674B404D3C1E3497CFEBA80242236C1435

First points to unsupported DNSKEY (512 bit RSA), second points to a key that doesn’t exist. Either you need to remove the DS record pointing to the missing key (5779), or add the missing key to the zone, or use RSA keys at least as strong as 1024 bits, see RFC 4641 - DNSSEC Operational Practices

[sdayman]

From what I read recently, a second DS record shouldn’t kill a domain if the other DS record is valid. Is this not true?

[user18460]

@mvavrusa THANK YOU. I immensely appreciate the support here. I can confirm that resolution is working again. I’ll take the output of what you’ve provided to CSC/Neustar and escalate the issue on that end. Once resolved there, I will report back.

[mvavrusa]

That’s true as long as there’s at least one key that is supported (RFC 4035 - Protocol Modifications for the DNS Security Extensions).

@user18460 no problem, sorry about the issues caused in the first place.