mnordhoff

5 ms·

1.
by mnordhoff 1y ago
Wait, Namecheap deactivates your domain name if you have a temporary DNS outage?
2.
by mnordhoff 1y ago
You should email them about the form and about your domain. Their email address is listed on the website. < https://quad9.net/support/contact/ > Sometimes the upstream blocklist provider will be easy to contac
3.
by mnordhoff 1y ago
Even without "all-servers", DNSMasq will race servers frequently (after 20 seconds, unless it's changed), and when retrying. A sudden outage should only affect you for a few seconds, if at all.
4.
by mnordhoff 1y ago
Unless the privacy policy changed recently, Google shouldn't be doing anything nefarious with 8.8.8.8 DNS queries.
5.
by mnordhoff 1y ago
This sounds like a very serious security vulnerability...?
6.
by mnordhoff 1y ago
Wellp. Incident report: "We posted our first incident report to Cloud Service Health about ~1h after the start of the crashes, due to the Cloud Service Health infrastructure being down due to this outage."
7.
by mnordhoff 3y ago
Related: < https://www.sprint.net/ >'s IP address was 2600:: for many years, but they sadly started using a DDoS mitigation service with different IPs.
8.
by mnordhoff 3y ago
Is collecting a shipping address because PayPal's JavaScript is broken legal under the GDPR?
9.
by mnordhoff 4y ago
In 2011, Gmail accidentally some people's email and restored it from tape. https://gmail.googleblog.com/2011/02/gmail-back-soon-for-eve...
10.
by mnordhoff 4y ago
Maybe not the entire region. Amazon was reportedly building a data center complex next to the natural gas Hermiston Generating Plant some distance from the river.
11.
by mnordhoff 4y ago
I have bad news for you, Linode's authoritative DNS service also uses Cloudflare DNS Firewall. $ dig +short ns1.digitalocean.com aaaa 2400:cb00:2049:1::adf5:3a33 $ dig +short ns1.linode.com aaaa 2400:cb00:2049:1::a29f:1a63
12.
by mnordhoff 4y ago
As I understood it, the difference between the $2.50 and $3.50 Vultr VPSes is an IPv4 address. I don't know why that page doesn't explain. Maybe it's changed.
13.
by mnordhoff 5y ago
This has a couple bugs: 1.1.1.2 and 1.1.1.3 both return the SVCB records for 1.1.1.1. (I don't know if clients would ignore them, or actually switch to 1.1.1.1.) Non-SVCB-type queries for _dns.resolver.arpa return NXDOMAIN instead of N
14.
by mnordhoff 5y ago
They moved data centers (to Hurricane Electric Fremont 2). It's not unusually unreliable.
15.
by mnordhoff 5y ago
Yup. I'm still upset (but not angry) about https://status.linode.com/incidents/kqhypy8v5cm8 .
16.
by mnordhoff 5y ago
Or if you open the EC2 console (it's up this time!) and scroll down to the bottom. https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#... : (Edit: I hope I didn't sound sarcastic. I don't op
17.
by mnordhoff 5y ago
Amazon seems to have stopped randomizing them in newer regions. Another reason to move to us-east-2. ;-)
18.
by mnordhoff 5y ago
Resolvers typically cache successful "does not exist" responses for no more than 1-3 hours. (And authoritative servers often have a lower negative TTL.) (There's a corner case related to DNSSEC that can make it go higher, but
19.
by mnordhoff 5y ago
No idea. I'd speculate that it's some kind of historical reasons from before FB acquired IG.
20.
by mnordhoff 5y ago
"Because of this Cloudflare’s 1.1.1.1 DNS resolver could no longer respond to queries asking for the IP address of facebook.com or instagram.com." The instagram.com zone itself uses a third-party DNS service and didn't go dow
21.
by mnordhoff 5y ago
"While Cloudflare signs all of its BGP routes with RPKI..." That's not correct. https://rpki.cloudflare.com/?view=bgp&asn=13335 itself says Cloudflare still doesn't sign 12% of them.
22.
by mnordhoff 5y ago
They shouldn't lose sleep over it, though.
23.
by mnordhoff 5y ago
Who sent them first, and why?
24.
by mnordhoff 5y ago
Instead of going from relying on a single provider to relying on a single provider, you could use both AWS and Azure.
25.
by mnordhoff 6y ago
DigitalOcean has /32s from ARIN and RIPE. (And a /48 from APNIC???) (Edit: And a /36, /40 and /48 from APNIC?)
26.
by mnordhoff 8y ago
Yup. And also one of the IPv4 IPs isn't doing TCP. I'm not sure nothing else is wrong, but the IPv6 issue is likely why 1.1.1.1 is having trouble resolving it.
27.
by mnordhoff 8y ago
Sharing the domain is usually critical. Picking a random domain hosted on those nameservers, mdfs.net, it looks like, of the 4 IPs, 2 are down and 1 of the remaining ones doesn't support TCP. http://dnsviz.net/d/md
28.
by mnordhoff 8y ago
> why the DNS test usualy takes >60 seconds The server-side part of DNS validation takes about a second. The delay is all about clients waiting for their authoritative DNS servers to update. If you use a fast DNS provider, there'
29.
by mnordhoff 9y ago
That's correct. Certbot can use different plugins for validating the name and for installing the certificate. You can configure HTTP-01 to work and use "certbot -a webroot -i nginx -w /path/to/whatever -d example.co
30.
by mnordhoff 9y ago
A number of web pages from better writers than me will argue why you need HTTPS. E.g. it provides integrity (so the coffee shop WiFi can't insert ads in your site), and browsers only enable some features on HTTPS sites. https:/&#

More ›