1

I have a every odd DNS issue.

dnslog.cn seems to point to 127.0.0.1 no matter which public dns I use. Anything hosted at localhost seems to accessible at http://dnslog.cn. The behavior is same on Firefox run via both Windows and via WSL2 i.e, it is not WSL specific. I am on Windows 11 and ran the following commands on WSL2 while debugging:

❯ nslookup dnslog.cn
Server:         172.23.176.1
Address:        172.23.176.1#53

Non-authoritative answer:
Name:   dnslog.cn
Address: 127.0.0.1
** server can't find dnslog.cn: SERVFAIL

❯ dig dnslog.cn

; <<>> DiG 9.18.12-1-Debian <<>> dnslog.cn
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6112
;; flags: qr rd ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;dnslog.cn.                     IN      A

;; ANSWER SECTION:
dnslog.cn.              0       IN      A       127.0.0.1

;; Query time: 29 msec
;; SERVER: 172.23.176.1#53(172.23.176.1) (UDP)
;; WHEN: Sat Mar 18 05:52:42 IST 2023
;; MSG SIZE  rcvd: 52

❯ ping dnslog.cn
PING dnslog.cn (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.021 ms
64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0.013 ms
64 bytes from localhost (127.0.0.1): icmp_seq=3 ttl=64 time=0.018 ms
64 bytes from localhost (127.0.0.1): icmp_seq=4 ttl=64 time=0.023 ms
64 bytes from localhost (127.0.0.1): icmp_seq=5 ttl=64 time=0.026 ms
^C
--- dnslog.cn ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4183ms
rtt min/avg/max/mdev = 0.013/0.020/0.026/0.004 ms

❯ traceroute dnslog.cn
traceroute to dnslog.cn (127.0.0.1), 30 hops max, 60 byte packets
 1  localhost (127.0.0.1)  0.075 ms  0.027 ms  0.004 ms

Nothing seems odd in resolv.conf, hosts or nsswitch.conf.

❯ cat /etc/resolv.conf
# This file was automatically generated by WSL. To stop automatic generation of this file, add the following entry to /etc/wsl.conf:
# [network]
# generateResolvConf = false
nameserver 172.23.176.1

❯ cat /etc/hosts
# This file was automatically generated by WSL. To stop automatic generation of this file, add the following entry to /etc/wsl.conf:
# [network]
# generateHosts = false
127.0.0.1       localhost
127.0.1.1       MyPCName. MyPCName

192.168.0.103   host.docker.internal
192.168.0.103   gateway.docker.internal
127.0.0.1       kubernetes.docker.internal

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Note that other devices on this network work correctly. Using a VPN fixes the issue on this machine too.

What could be making the DNS server return 127.0.0.1 for only a specific site dnslog.cn?

UPDATE:

Turns out this issue is not on my setup but the DNS Servers including Google DNS.

Cloudflare DNS works fine.

I wonder where we can report DNS inconsistencies.

6
  • Why do you believe dnslog.cn should resolve to anything? It certainly doesn't resolve to anything for me.
    – Ramhound
    Mar 18, 2023 at 4:30
  • @Ramhound it does for me (It resolves to 42.244.138.18) if anyone wants to hardcode it into /etc/hosts.
    – davidgo
    Mar 18, 2023 at 5:12
  • What do you mean by "no matter what public DNS you use"? Where are you specifying the public DNS? I do wonder if dnslog.cn is blocking based on geopolitics - I am in a country which is not seen by China as hostile to them.
    – davidgo
    Mar 18, 2023 at 5:19
  • Interestingly, when I try (anything).dnslog.cn it returns 127.0.0.1, but still allows me to track it. It is possible that they had a bug that is being cached? Similarly, when I do a "dig [at] 1.1.1.1 dnslog.cn ns" its not returning a nameserver but "dig @1.1.1.1 dnslog.cn" returns an IP address.
    – davidgo
    Mar 18, 2023 at 5:26
  • I hadn't tried cloudflare DNS yet. Changing to Google DNS and some other DNS servers in the DNSJumper list wasn't helping so I thought it was a dead end.
    – Anutrix
    Mar 18, 2023 at 6:59

0

You must log in to answer this question.

Browse other questions tagged .