0

I was thinking about a DNS issue but now I am waiting for months and I still have the issue.

One month ago I configured a domain test.my-domain.com

But chrome is returning me DNS_PROBE_FINISHED_NXDOMAIN

Doing ping test.my-domain.com I have the same issue ping: cannot resolve test.my-domain.com: Unknown host

People from outside can access the website without issues. On the same network, I can access the website with my phone.

I tried to set google dns 8.8.8.8 and 8.8.4.4 but same issue

A also tried to connect through a vpn and same issue

I rebooted my mac many times, reset DNS cache and nothing change

I can access from everywhere but not on my mac, Today I tried to configure on the root domain my-domain.com, exact same issue everyone can see it but not working on my mac

Improve this question
7
  • 1
    RE: "One month ago I configured a domain test.my-domain.com" -- How exactly did you configure this?
    – user3439894
    Sep 6, 2021 at 12:16
  • with cloudflare, nothing on my local machine
    – Ajouve
    Sep 6, 2021 at 12:16
  • What is the actual real domain name so I can see if I can ping it?
    – user3439894
    Sep 6, 2021 at 12:20
  • webtop.blog, should work for you, this is only an internal issue
    – Ajouve
    Sep 6, 2021 at 12:26
  • 1
    @bmike For example I have an android phone and an Iphone on the same network, both displaying the website without issue. I have someone with a mac on an other network who does not have issue and an other person with a windows on an other network and it works. I tried connection my mac to my iphone and sams issue
    – Ajouve
    Sep 6, 2021 at 12:52

1 Answer 1

Reset to default
3

The problem is that your DNS configuration for the domain is invalid. You need to fix that at CloudFlare (i.e. at the level of your authoritative DNS service) - it is not a problem with your Mac.

The problem with your DNS configuration is that your domain, webtop.blog, is advertised to be protected by DNSSEC - but it is not setup.

In simple terms, DNSSEC is used to ensure integrity of DNS responses by using cryptography to sign DNS records at each level of DNS lookups. This ensures that others cannot suddenly takeover your domain and start publishing records for it (for example in a man-in-the-middle attack on a specific network) - DNSSEC-enabled systems would detect that the modified DNS records do not have the right signature, and the lookups would fail.

In your case, you have setup CloudFlare to send out DNS responses for your domain - such as for example A records with IP addresses for your web server. However, you have not setup CloudFlare to send out DNSSEC records.

This means that the domain fails DNSSEC validation.

Some systems do not understand DNSSEC or purposely do not validate it, and on these systems your domain will work.

On other systems, such as for example Google public DNS (8.8.8.8/8.8.4.4), a failure to provide the correct DNSSEC records means that all lookups will fail.

You can find a guide on how to add DNSSEC records to your CloudFlare DNS here:

https://support.cloudflare.com/hc/en-us/articles/360006660072-Setting-up-DNSSEC-in-Cloudflare

You can see that your domain is setup for DNSSEC at the registry by a simple DNS lookup from your Mac:

dig -t ds @a.nic.blog webtop.blog

You'll find that the reply contains a DNSSEC as listed here:

webtop.blog.        3600    IN  DS  16264 8 2 2876E6FCB382D01DDDBEBD7B5DF48D5BF261A4F852DB918CC1AAE1E5 172163E6

However, when asking for the DNSSEC records from CloudFlare like this:

dig -t ds @logan.ns.cloudflare.com webtop.blog

You'll get no records.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .