Unable to Resolve www.worldometers.info

johnpoz

Well I would say something is blocking port 53 to them then, either on your end, or the ISP or cloudflare themselves - or something between.

But if you can not query them - then you can not resolve stuff they are authoritative for.

Are you forcing traffic out a vpn connection? What part of the world are you in - is it one where they dick with dns queries?

Can you query them for something else? Say for example.

$ dig @collins.ns.cloudflare.com cloudflare.com

; <<>> DiG 9.16.1 <<>> @collins.ns.cloudflare.com cloudflare.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38819
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;cloudflare.com.                        IN      A

;; ANSWER SECTION:
cloudflare.com.         300     IN      A       104.17.175.85
cloudflare.com.         300     IN      A       104.17.176.85

;; Query time: 16 msec
;; SERVER: 162.159.38.226#53(162.159.38.226)
;; WHEN: Mon May 04 06:40:32 Central Daylight Time 2020
;; MSG SIZE  rcvd: 75

hhoong

@johnpoz

No VPN, I'm from Malaysia,
I have 3 pfsense across 3 location, all using same telco, all 3 not working

[2.4.5-RELEASE][admin@pfSense-Router.HuiHoong.Home]/root: dig @collins.ns.cloudflare.com cloudflare.com

; <<>> DiG 9.14.9 <<>> @collins.ns.cloudflare.com cloudflare.com
; (2 servers found)
;; global options: +cmd
;; connection timed out; no servers could be reached
[2.4.5-RELEASE][admin@pfSense-Router.HuiHoong.Home]/root:

johnpoz

@hhoong said in Unable to Resolve www.worldometers.info:

all using same telco

Well that would seem to be a problem then with them.

You for whatever reason can not query them for dns - so no you wouldn't not be able to resolve anything that they are authoritative for..

Can you get to https://www.cloudflare.com/

even - maybe they don't like your ISP and are blocking them ;) Do you get a captcha when you try and access?

hhoong

@johnpoz said in Unable to Resolve www.worldometers.info:

@hhoong said in Unable to Resolve www.worldometers.info:

all using same telco

Well that would seem to be a problem then with them.

You for whatever reason can not query them for dns - so no you wouldn't not be able to resolve anything that they are authoritative for..

Can you get to https://www.cloudflare.com/

even - maybe they don't like your ISP and are blocking them ;)

thanks for the info :)

i guess now the only way for me to able to query www.worldometers.info is to enable forwarding in my DNS resolver.

i can access to https://www.cloudflare.com/ main page,

@hhoong said in Unable to Resolve www.worldometers.info:

@johnpoz

can ping can nslookup
odd right >.<

[2.4.5-RELEASE][admin@pfSense-Router.HuiHoong.Home]/root: ping collins.ns.cloudflare.com
PING collins.ns.cloudflare.com (162.159.38.226): 56 data bytes
64 bytes from 162.159.38.226: icmp_seq=0 ttl=61 time=12.373 ms
64 bytes from 162.159.38.226: icmp_seq=1 ttl=61 time=11.953 ms
64 bytes from 162.159.38.226: icmp_seq=2 ttl=61 time=13.656 ms
64 bytes from 162.159.38.226: icmp_seq=3 ttl=61 time=13.199 ms
64 bytes from 162.159.38.226: icmp_seq=4 ttl=61 time=15.022 ms
64 bytes from 162.159.38.226: icmp_seq=5 ttl=61 time=13.560 ms
^C
--- collins.ns.cloudflare.com ping statistics ---
6 packets transmitted, 6 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 11.953/13.294/15.022/0.987 ms
[2.4.5-RELEASE][admin@pfSense-Router.HuiHoong.Home]/root: nslookup collins.ns.cloudflare.com
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   collins.ns.cloudflare.com
Address: 162.159.38.226
Name:   collins.ns.cloudflare.com
Address: 2606:4700:50::a29f:26e2

[2.4.5-RELEASE][admin@pfSense-Router.HuiHoong.Home]/root:

i can ping and nslookup to the collins.ns.cloudflare.com as well, maybe is time for me to get a VPN

provels

Could the ISP be blocking DNS to any servers but their own?

johnpoz

No since from his trace he talked to roots, and the affiliates.. He got told where to go for his domain in his trace.. He just can't seem to get there.

hhoong

@provels

I'm not sure but overall my DNS resolver was working, i just notice this www.worldometers.info not working for now, not sure of any other that is not working.
But base on what u said, maybe all that register under @collins.ns.cloudflare.com, most likely i not able to query ...

johnpoz

No you would not be able to resolve anything that you can not talk to the authoritative NS for.. When you resolve you directly talk to the authoritative NS for that domain.. If you can not get to any of them, then anything they are authoritative for would fail to resolve..

That is how resolving works.. You get the info straight from the horses mouth - if you can not talk to the horse, then yeah you going to have a bad day.

I would get with your ISP to be honest, and ask them why you can not query that NS.

hhoong

@johnpoz said in Unable to Resolve www.worldometers.info:

No you would not be able to resolve anything that you can not talk to the authoritative NS for.. When you resolve you directly talk to the authoritative NS for that domain.. If you can not get to any of them, then anything they are authoritative for would fail to resolve..

That is how resolving works.. You get the info straight from the horses mouth - if you can not talk to the horse, then yeah you going to have a bad day.

yea ... sad,
i was so excited when i was able to not to "leak my DNS", now seem like i have to open up back to 1.1.1.1

johnpoz

Ask your ISP why you can not query that ns or the other one listed.

moura.ns.cloudflare.com

You can ping them - so you have connectivity to them, so why no query on 53?

hhoong

@johnpoz said in Unable to Resolve www.worldometers.info:

Ask your ISP why you can not query that ns or the other one listed.

moura.ns.cloudflare.com

You can ping them - so you have connectivity to them, so why no query on 53?

i don't think they will entertain me, they would ask me to use DNS forwarder and point to them.

do pfsense resolver support DNS over SSL/TLS for outgoing to root DNS? if can, what if i enable?
i dont seem to able to find that option.

johnpoz

@hhoong said in Unable to Resolve www.worldometers.info:

SSL/TLS for outgoing to root DNS?

No doesn't work that way... Every single NS on the planet would have to support tls for something like that to work.. And GAWD would be be horribly slow!!!

hhoong

@johnpoz

Then is sad, so for the time been i have to enable forward in my DNS resolver
until i get a VPN... haha

thanks for all the help :)

johnpoz

Well if you have only found that specific one - you could prob just do a domain override to send that domain to wherever..

hhoong

@johnpoz
hmm, let me try ...

johnpoz

But if you can not talk to those specific ns for cloudflare, its possible you can not talk to others. Also I would "assume" that those ns are used for more than just that specific domain.. So there could be others that you can not resolve - that you have just not found yet.

So while a conditional forward would allow you to resolve this specific domain, you could have things that don't resolve later that you have just not run across yet. So it would be a wack-a-mole game.. The root of the problem is you can not talk to those NS for whatever reason via dns query.

Gertjan

This one :

@johnpoz said in Unable to Resolve www.worldometers.info:

moura.ns.cloudflare.com

and it's brother collins.ns.cloudflare.com are most probably servers or VPS hosted by cloudflare. To me, it like they are dedicated servers that have as a role : a name server.
But they are managed by a private person, because :
Double; identical A records are returned.
Both name servers are in the same AS : that a DNS bad practice.
"cloudfare" should never done that.
And private person means : a trigger happy server with fail2ban, DNSBL software ....

This ll boils down to : you got yourself probably blacklisted - or worse, your (ISP) WAN IP is on some blacklist, used by the guy who operates worldoyyyymeters.info.

edit : I just had a look at what that site www.worldoyyyyymeters.info is ... a Corona counter ...

johnpoz

Where do you see they return the same IP?

;; ANSWER SECTION:
collins.ns.cloudflare.com. 86383 IN A 162.159.38.226

;; ANSWER SECTION:
moura.ns.cloudflare.com. 86375 IN A 162.159.44.217

They are are in different networks..

And that network is owned by cloudflare.. And while they are part of the same block, there is nothing wrong with having 2 ns in the same AS.. They just shouldn't be on the same network.. You could have same AS all over the globe, so there is no reason why they couldn't be in the same AS.. In a perfect world sure - you would put your NS in completely different AS, I agree.

But sure if those are hosted by cloudflare for someone, if that someone runs that NS, then sure they could of blocked his IP or block.. Its its possible cloudflare is actually blocking his IP.. very possible!

hhoong

@johnpoz said in Unable to Resolve www.worldometers.info:

Where do you see they return the same IP?

;; ANSWER SECTION:
collins.ns.cloudflare.com. 86383 IN A 162.159.38.226

;; ANSWER SECTION:
moura.ns.cloudflare.com. 86375 IN A 162.159.44.217

They are are in different networks..

And that network is owned by cloudflare.. And while they are part of the same block, there is nothing wrong with having 2 ns in the same AS.. They just shouldn't be on the same network.. You could have same AS all over the globe, so there is no reason why they couldn't be in the same AS.. In a perfect world sure - you would put your NS in completely different AS, I agree.

But sure if those are hosted by cloudflare for someone, if that someone runs that NS, then sure they could of blocked his IP or block.. Its its possible cloudflare is actually blocking his IP.. very possible!

y they wanna block me... I'm so sad :(

Gertjan

@johnpoz said in Unable to Resolve www.worldoyyyymeters.info:

Where do you see they return the same IP?

Here :

AS : do something like https://www.zonemaster.net/domain_check

@johnpoz said in Unable to Resolve www.worldoyyyymeters.info:

there is nothing wrong with having 2 ns in the same AS

It will work just fine. It just not good practice. Most domain - name - root server tester will tell you this.

@johnpoz said in Unable to Resolve www.worldoyyyymeters.info:

And that network is owned by cloudflare.

The network, yes. These name server : I guess probably not - as said, some rented dedicated server.