SERVFAIL if nameservers are not reachable in IPv6 but they are in IPv4


#1

Ok, so it seems 1.1.1.1 does not failover to IPv4 if a nameserver do not respond over IPv6

dig mechanicus.it @\1.1.1.1

; <<>> DiG 9.10.3 <<>> mechanicus.it @\1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 31590
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;mechanicus.it.                 IN      A

;; Query time: 4591 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Sat Sep 01 14:34:36 ora legale Europa occidentale 2018
;; MSG SIZE  rcvd: 42

dig mechanicus.it @\1.0.0.1

; <<>> DiG 9.10.3 <<>> mechanicus.it @\1.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19113
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;mechanicus.it.                 IN      A

;; Query time: 4916 msec
;; SERVER: 1.0.0.1#53(1.0.0.1)
;; WHEN: Sat Sep 01 14:34:45 ora legale Europa occidentale 2018
;; MSG SIZE  rcvd: 42

dig mechanicus.it @\8.8.8.8

; <<>> DiG 9.10.3 <<>> mechanicus.it @\8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62958
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mechanicus.it.                 IN      A

;; ANSWER SECTION:
mechanicus.it.          14399   IN      A       185.56.218.11

;; Query time: 250 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 01 14:34:50 ora legale Europa occidentale 2018
;; MSG SIZE  rcvd: 58

dig +short CHAOS TXT id.server @\1.1.1.1 “MXP”
dig +short CHAOS TXT id.server @\1.0.0.1 “MXP”

http://dnsviz.net/d/mechanicus.it/dnssec/

My ISP AFAIK do not provides name resolution over IPv6.
Nameservers:

Everything was fine until few days ago.


#2

Not sure if the same, but I observed a similar thing recently - IPv6 timeouts appear to be racey


#3

It could be the same, after IPv6 timeout there isn’t an IPv4 attempt apparently.


#4

As an update, 1.0.0.1 seems to work sometimes, with multiple queries about the same domain.
When 1.0.0.1 get the result in cache, then also 1.1.1.1 serves it.