28

I have a new website and its DNS entry (thetunegame.com) is now 10 days old, so it should have propagated properly.

I've had over 200 people from several countries accessing it with no issues, however there are 4 people, all from Greece (although this could be a sample bias), who can't access it. One sent me this screenshot:

enter image description here

I understand this means their system can't find a DNS entry. I'm not an expert and this is not my own system, so I'm limited as to what I can do, however I have ascertained that:

  1. Changing to Google DNS servers (and doing ipconfig /flushdns) does not solve it
  2. Changing network does solve it
  3. Not all 4 people are on the same network/ISP (therefore it's not an issue with a particular ISP)
  4. Changing browser does not solve it (in case it was a Chrome caching issue)

My set up:

  • Google-registered domain, pointing to Cloudflare DNS
  • Cloudflare has DNSSEC enabled (in case that matters)

Things I've tried:

  • Asking the people who have this issue to do the things described above
  • Test the DNS resolves OK for me and for servers around the world via several online tools (it does)
  • Checked the DNSSEC settings between Google and Cloudflare are consistent

I'm completely stuck! I can't understand how 4 people (not on the same network) can't see it, even when trying via Google DNS servers.

I have no idea what else to test, in case it's something wrong with my setup.

Is there a way of confirming that my setup is correct?

And if it is, what else can I ask these people to try?

Improve this question
3
  • 2
    unrelated but I did the movie soundtrack one and it told me I got 6 out of 5 right. – Dean MacGregor Jan 14 at 14:37
  • @DeanMacGregor Thanks for the feedback. I'm aware that if you go back and give the right answer again, it counts it twice ;) It was a 3-day project I did over my Xmas break to get back into programming. I want to make fixes, but with a 9-5 job it takes a bit of time. Hope you enjoyed it! :) – Anthony Jan 14 at 22:02
  • I didn't go back, my point was that you seem to have the variable for questions right and the variable for total questions mixed up – Dean MacGregor Jan 15 at 12:24
52

Checked the DNSSEC settings between Google and Cloudflare are consistent

They are not. The delegation you submitted through Google specified an RSA key (algorithm 5), but the actual zone at Cloudflare is using an ECDSA P-256 key (algorithm 13).

You can see the DNSSEC validation status at DNSViz: original scan, latest scan.

Algorithm mismatch makes signatures impossible to verify, so people using validating resolvers will get a SERVFAIL error while non-validating resolvers have no issues with the domain. The Google public resolver (8.8.8.8) is a validating one.

To fix this, change the DNSSEC settings at Google to specify ECDSA P-256 (13) as the algorithm. You may need to wait up to 24 hours for the old DS records to expire from caches. (DNSViz will bypass caching and will see the changes sooner, but you have to click "Update now" to refresh the diagram.)

1 (The shown key size of 512 bits is normal for an EC P-256 key.)

Improve this answer
3
  • 1
    Thank you so much, this was extremely helpful! I had a hunch DNSSEC was involved, but had no idea of DNSViz. My way of checking was: Go to Cloudflare, get the key, go to Google confirm the key is the same. (And both Google and Cloudflare show green tickmarks next to DNSSEC! I wish they'd check somehow!) I'll start by disabling DNSSEC and take it from there. Thanks again! – Anthony Jan 13 at 0:31
  • 7
    Normally validation is top-down, so the important part would be removing DS records at the delegation (Google) -- disabling signing at Cloudflare probably won't make any difference. (However, the place where you submit the key at Google should have a "key algorithm" dropdown selection of some kind, so you might as well simply change it to the correct type instead of deleting it outright...) – user1686 Jan 13 at 9:38
  • That's helpful, thank you. Just a quick note that it's working (with DNSSEC off). I may attempt to re-enable it one day, but from what I read when I was doing research there are debates around its usefulness (also, since only 4 out of 200 people reported an issue, it tells me that any safeguarding effect will unfortunately be very limited). Thanks again. – Anthony Jan 14 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.