Hello,
dig sistemapiemonte.it @1.1.1.1
; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> sistemapiemonte.it @1.1.1.1
;; OPT PSEUDOSECTION:
;; Query time: 4211 msec
Regards.
Judge
June 27, 2019, 2:44pm
#2
Doesn’t look like this domain has any DNSSEC issues, so the issue has to be something with the authoritative DNS not responding to queries from Cloudflare.
Doing a reverse NS search for other domains with the same nameservers, dns1.csi.it and the other one, you can see it happens on every domain using these nameservers:
dig rescueweb.it @1.1.1.1 #servfail
dig tief2016.org @1.1.1.1 #servfail
dig aslto1.it @1.1.1.1 #servfail
The only reason this would happen is if that DNS service blocks CF’s IP ranges for whatever reason, but there’s nothing CF can do about it.
Here’s their contact page: http://www.csipiemonte.it/web/it/contatti-e-sedi#t3-mainnav
sandro
June 27, 2019, 2:58pm
#3
@matteo , non sei più da solo
@gianluca , there seem to be currently some issues with Cloudflare resolving domains managed by csi.it. So far it is not clear where the issue is.
1 Like
matteo
June 27, 2019, 3:00pm
#4
@gianluca yep, happened yesterday as well. It will solve in the evening.
Couldn’t actually find a reason, as @judge said there is no DNSSEC. The NS seem to work when called directly.
1 Like
Sathio
July 9, 2019, 9:22am
#5
I just realised several sites don’t work with 1.1.1.1, i’m not sure where the issue is, can anyone look into this please?@8.8.8.8 @8.8.8.8
Sathias-iMac:~ sathia$ dig www.soris.torino.it @1.1.1.1
; <<>> DiG 9.10.6 <<>> www.soris.torino.it @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 63297
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;www.soris.torino.it. IN A
;; Query time: 4210 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Tue Jul 09 11:14:56 CEST 2019
;; MSG SIZE rcvd: 48
matteo
July 9, 2019, 9:46am
#6
Unfortunately this has been going on for a while, I don’t know why it works for half of the day…
Maybe @cloonan can connect me with someone internally that can run some tests…
I have the same problem with the hostname WWW.SISTEMAPIEMONTE.IT.
I have no idea why.
matteo
July 23, 2019, 4:27pm
#9
I have seen that has been continuing… It’s something that has to do with the csi.it nameservers and Cloudflare.
@cloonan someone I can email and check that with?
I suspect it’s best to let support know. They can escalate if need be.
matteo
July 23, 2019, 4:48pm
#11
Will do now. Thanks! I’ll keep you all updated, please do not duplicate the support request
1 Like
matteo
July 23, 2019, 5:16pm
#12
Update to everyone here. Got a reply from Celeste (thanks if you ever read this!).
She did a couple of test from their end and the name servers are blocking Cloudflare’s IPs. We should contact CSI directly.
For @cloonan , if you want to take a look it’s ticket #1723577 .
2 Likes
Hi Judge,
your reply is very valuable. I am going to contact CSI to see if they have blacklisted the CloudFare IPs.
I didn’t think about this potential root cause of blacklisting.
1 Like
I have sent an email to {pii redacted} in order to inform them that their name servers do not respond to CF’s IPs. I will keep you posted. Thanks to all of you, guys.
1 Like
Hi,
the issue is now solved. CSI has whitelisted the CloudFare IPs and now it works.
2 Likes
