Wrong geolocation for outlook.office.com from Belgium

Hello,

Since a few days, when we are using Cloudflare Zero Trust Gateway or 1.1.1.1 servers, we have a wrong location returned for some of the queries for outlook.office.com.
Instead of returning a location like Amsterdam or London we receive a location in Cape Town Africa so all the Outlook of our users are connected to Africa instead of Europe.

So the latencies are high.

This is the case from several Belgium providers using 1.1.1.1 servers for the following domain : outlook.office.com

> outlook.office.com
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    cpt-efz.ms-acdc.office.com
Addresses:  2603:1006:1:21::2
          2603:1006:1:24::2
          2603:1006:1:1::2
          2603:1006:1:25::2
          40.99.204.82
          40.101.83.18
          52.98.231.242
          40.99.204.130
Aliases:  outlook.office.com
          substrate.office.com
          outlook.office365.com
          ooc-g2.tm-4.office.com
          outlook.ms-acdc.office.com

We should receive something like that :

> outlook.office.com
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    AMS-efz.ms-acdc.office.com
Addresses:  2603:1026:207:163::2
          2603:1026:c03:581a::2
          2603:1026:204:1::2
          2603:1026:207:f5::2
          52.98.21.18
          52.98.16.242
          52.98.23.242
          52.98.16.226
Aliases:  outlook.office.com
          substrate.office.com
          outlook.office365.com
          ooc-g2.tm-4.office.com
          outlook.ms-acdc.office.com```

It's not limited to one of our customers but to many of them.

Do you have any idea of what could be the issue?

Thank you.

Hi @jeremylogicaltic, sorry about these issues. This seems like what the resolver is getting from ooc-g2.tm-4.office.com nameservers. There’s another issue here as sometimes there’s a CNAME to outlook.ms-acdc.office.com, and sometimes list of addresses some of them closer some further away. I’ll try to reach someone at Microsoft to see if they can take a look at it.

Can you confirm you’re connected to AMS colo? See Have problems with 1.1.1.1? *Read Me First*

Hello @mvavrusa,
First of all, thank you for your help.

Here is the output of the commands from one of the impacted network :

PS C:\Users\jeremy> nslookup -class=chaos -type=txt id.server 1.1.1.1
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
id.server       text =

        "BRU"
PS C:\Users\jeremy> tracert 1.1.1.1

Tracing route to one.one.one.one [1.1.1.1]
over a maximum of 30 hops:

  1     2 ms     6 ms     2 ms  192.168.150.1
  2    11 ms    10 ms    10 ms  10.161.10.97
  3    15 ms    13 ms    12 ms  mx-str-1-ae115-300.voo.be [78.129.125.45]
  4    19 ms    17 ms    13 ms  mx-bxl2-2-ae0-0.voo.be [212.68.211.141]
  5    22 ms    24 ms    15 ms  cloudflare.belgiumix.net [185.1.127.13]
  6    14 ms    14 ms    15 ms  one.one.one.one [1.1.1.1]

Trace complete.

Regarding the following command : nslookup -type=txt whoami.Cloudflare.com ns3.Cloudflare.com I’ve tried it from multiple network and sometimes in the output I have the correct public IP and sometimes the one from another provider (not always the same).
I’ve tried the same command on 4 different locations in Belgium not all linked to the same internet provider (3 different provider).

Thank you.

Hello @mvavrusa,

Did you get any feedback from Microsoft side.
The issue is still the same and it’s only coming from Cloudflare.

Thank you.

Hi @jeremylogicaltic I’m sorry I forgot to follow up here. The issue was intermittent (some nodes in the same pop seems to have correct geo and some do not). I made a ticket to track this internally but also added a rule to move the upstream traffic through nearby Cloudflare pops (and not BRU) which seems to have correct geo on the Microsoft’s side, so you should see some improvement.

3 Likes

Hi @mvavrusa ,

Thank you for your feedback and your help.
The issue seems to be solved.

Best regards

1 Like

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.