DNS Resolver problems

Chrismallia

can you load this
http://speedtest.melita.com/speedtest/latency.txt

just direct in your browser?

No I get a page error in my browser, do you want logs of server that works? I tried other browsers PCs and phone still the same error

johnpoz

what do you get when you try and resolve it.. Use nslookup, or dig or drill or even the diag lookup page on pfsense.

Try to ping the name - does it come back with IP or unknown host, etc.

Let me see if that domain has dnssec enabled that is broken

edit: I don't show them having dnssec available… But its quite possible your having issue with connectivity to their authoritative servers..

But I do show their dns to be hosed from online testers

I show their 1 server for sure not answering

;; ANSWER SECTION:
melita.com. 3600 IN NS ns1.melitacable.com.
melita.com. 3600 IN NS ns.melitacable.com.

;; ADDITIONAL SECTION:
ns.melitacable.com. 3600 IN A 212.56.128.132
ns1.melitacable.com. 3600 IN A 212.56.128.196

so while .196 answers, I can not get a response from .132

; <<>> DiG 9.9.5-3ubuntu0.7-Ubuntu <<>> @212.56.128.132 melita.com NS
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

So it would seem they have issues.. Might be connectivity from parts of the world, etc.

Well now another query works... So they could be having issues.. If your resolving and having problems talking to their NS then yes that could explain why using forwarder works since your just asking for something that a NS already has cached.

dnsproblems.png_thumb

Chrismallia

In the browser I get
This webpage is not available

DNS_PROBE_FINISHED_NXDOMAIN

In pfsense dns lookup I get

Host must be a valid hostname or IP address.

In cmd ipconfig I get

Ping request could not find host http://speedtest.melita.com/speedtest/latency.txt. Please check the name and try again.

johnpoz

yeah your having issues resolving their dns… you could try a trace in say nslookup or dig.

But that explains your problem - your having problems resolving that domain.. You could try putting in a host over ride.

I show that server resolving to.. 212.56.138.60

So in the resolver create a host override for speedtest with melita.com as domain and that IP.. then see if you can ping by name

Where I see a major issue is they have a TTL of 100 seconds

So when they do resolve, it doesn't stay cached long

;; ANSWER SECTION:
speedtest.melita.com. 100 IN A 212.56.138.60

;; AUTHORITY SECTION:
melita.com. 3600 IN NS ns.melitacable.com.
melita.com. 3600 IN NS ns1.melitacable.com.

;; ADDITIONAL SECTION:
ns.melitacable.com. 3600 IN A 212.56.128.132
ns1.melitacable.com. 3600 IN A 212.56.128.196

Trying to query their servers seems to be hit and miss.. Sometimes it works, and then it fails… So even when you do get it resolved, it only stays cached for 100 seconds.

If they are your isp you might want to contact them their dns is messed up!!!

Their SOA is WRONG too...

;; QUESTION SECTION:
;speedtest.melita.com. IN SOA

;; AUTHORITY SECTION:
melita.com. 3561 IN SOA helium.melitacable.com. domains.melitacable.com. 2016022500 28800 7200 2419200 86400

SOA should point to 1 of their name servers..

Chrismallia

wow your Great so that explains it you should come to Malta and give them a lecture lol ye they are my ISP that might explane some issues they are having with internet disconnects and slow downs ? everyone is complaining and they say they have no problems lol. Please how can I donate something to Thank you for the hole day you spent with me and for all the work?

Chrismallia

And btw for plex under advance alternative host name I put plex.direct and it is now working great. I can't thank you enough

Chrismallia

I just gave $20 to free bsd from your link https://www.freebsdfoundation.org/donate/ and have the email to prove it if you would like to see. I also thankt you in the comment box. Regards friend and thank you again

johnpoz

No problem - thanks for the donation.. You use to be able to donate direct to pfsense, but this is how they want donations now.

I do this for fun, I like tech problems and helping people resolve them. Getting useful info is normally the hard part.

Yeah I would say they are having all kinds of issues. Is that the dns they hand out to their subscribers? Or is that just their authoritative dns for their own domain? When you let pfsense get dns from your isp what IPs do you get? It doesn't seem to be an open resolver so that is good ;) I get a refused when try and query say google.com off of them.

What I can see as problems is that SOA helium.melitacable.com is not even a valid record in their nameservers. I see that both the name servers are on the same ASN (same network) looks to be the same class C. This is BAD IDEA!!! If problem with that network both nameservers are down.. Most likely they are in the same location too, this is bad - what happens if location has outage?

The SOA expire is quite long at 2419200, this should be more like 1 week, 2 weeks tops not 28 days (4 weeks)

Doesn't look like their MX accepts mail for postmaster, which is BAD.. And breaks all kinds of rfc's and there isn't even a SPF record.. Some fly by night shitty little ISP to be sure ;)

Chrismallia

Here are the dns I get when I let pfsense use there dns 212.56.129.228 and
212.56.132.20 :)
Unfortunately Here in Malta we only have Melita. VODAFONE (4G) and another is GO but GO do not have fiber everywhere yet, :) when you have time is it possible for you to check on GO please? and tell me if they are better. O n speedtest there server are MARSA that by the way speedtest works fine for me when I use there servers :) and if possible Vodafone is b'kara. Thanks again for all your help thanks to you I will choose the better ISP when available

johnpoz

well those ns are not open for people to query them when not on that isp… When I try and query them I get refused. Which is typical setup for ISP name servers.

Is this your go site?

https://www.go.com.mt

They have some issues with their dns as well.. Its not that hard people ;) heheheh

They got no glue for 2 of their names servers, they have 4 of them. They are running old version of Bind on atleast 2 of them.

195.38.30.13: "9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.3"

That was Deprecated back in like 2009... WTF???

They got the same issue where their listed SOA doesn't have record ns1.go.com.nt -- and I show ns1 and ns2 being open you can query them for www.google.com and get an answer..

Based solely on their shameful setup of their authoritative name servers for their own freaking domain I would say yeah they have basic lack of technical skill required to run a freaking ISP ;) But that just me an grumpy old man on the internet that has been doing this for 30 some years ;)

Chrismallia

loooll yes that go site hehehe wow 1 worse then the other lool. sorry but have you checked the vodafone that is the last one lol? I really love your opinions lool