[AusNOG] DNS problems resolving sync.deakin.edu.au

[John Mann]

Hi,

In summary ... the problem was with a lowercase domain name rewrite rule
and F5 CGNAT boxes doing case-randomised DNS queries.

Fixed with help from John Alexander, Russell Langton, Jahanzeb and team at
Belong.

Thanks,
     John

On Wed, 28 Nov 2018 at 15:59, John Mann <john at mannfamily.org> wrote:

> Joseph,
>
> If it was DNS propagation, then wouldn't the users be getting the old
> addresses, rather than NXDOMAIN.
>
> There is a chain of CNAMES ...
> ---
> $ host sync.deakin.edu.au
> sync.deakin.edu.au is an alias for sync.global.deakin.edu.au.
> sync.global.deakin.edu.au is an alias for sync.deakin.edu.au.edgekey.net.
> sync.deakin.edu.au.edgekey.net is an alias for e7158.dsca.akamaiedge.net.
> e7158.dsca.akamaiedge.net has address 23.53.136.100
> e7158.dsca.akamaiedge.net has IPv6 address 2001:8006:3510:1297::1bf6
> e7158.dsca.akamaiedge.net has IPv6 address 2001:8006:3510:12a9::1bf6
> ---
> but it's not longer than
> ---
> $ host www.deakin.edu.au
> www.deakin.edu.au is an alias for www.global.deakin.edu.au.
> www.global.deakin.edu.au is an alias for deakin.edu.au.edgekey.net.
> deakin.edu.au.edgekey.net is an alias for e7158.a.akamaiedge.net.
> e7158.a.akamaiedge.net has address 23.53.136.100
> ---
>
> One Aussie Broadband user reported that when they were opted out from
> CGNAT, things started working for them.
>
> Thanks,
>     John
>
> On Wed, 28 Nov 2018 at 15:52, Saxton, Joseph (SYD-FED) <
> Joseph.Saxton at interpublic.com> wrote:
>
>> If it’s only changed recently then I’d say DNS propagation
>>
>>
>>
>> *From: *AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of John Mann <
>> john at mannfamily.org>
>> *Date: *Wednesday, 28 November 2018 at 3:44 pm
>> *To: *"AusNOG at lists.ausnog.net" <AusNOG at lists.ausnog.net>
>> *Subject: *[EXTERNAL] [AusNOG] DNS problems resolving sync.deakin.edu.au
>>
>>
>>
>> Hi,
>>
>>
>>
>> Deakin University recently dual-stacked their Akamai cache for
>> sync.deakin.edu.au
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__sync.deakin.edu.au&d=DwMFaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=aVUTlDm-TpQmLPh8GYduaIdrwFkUij4wtBrv-X9yJz4&s=oyHoAo4mklGmb_jm-rzKYPvvofKEu68LWO4doCFkURg&e=>
>> .
>>
>>
>>
>> Since them, some students using a couple of ISPs can't resolve the DNS
>> name.
>>
>> For example:
>>
>> ---
>>
>> > nslookup sync.deakin.edu.au
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__sync.deakin.edu.au&d=DwMFaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=aVUTlDm-TpQmLPh8GYduaIdrwFkUij4wtBrv-X9yJz4&s=oyHoAo4mklGmb_jm-rzKYPvvofKEu68LWO4doCFkURg&e=>
>>
>> Server:  belong.gateway
>>
>> Address:  10.0.0.138
>>
>>
>>
>> *** belong.gateway can't find sync.deakin.edu.au
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__sync.deakin.edu.au&d=DwMFaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=aVUTlDm-TpQmLPh8GYduaIdrwFkUij4wtBrv-X9yJz4&s=oyHoAo4mklGmb_jm-rzKYPvvofKEu68LWO4doCFkURg&e=>:
>> Non-existent domain
>>
>> ---
>>
>> "blogs.deakin.edu.au
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__blogs.deakin.edu.au&d=DwMFaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=aVUTlDm-TpQmLPh8GYduaIdrwFkUij4wtBrv-X9yJz4&s=yFkD80CkEe2Z-d4Pp3L8fWNbGaFEpnm7FGr0j6Jy6bc&e=>"
>> is setup similarly to "sync.deakin.edu.au
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__sync.deakin.edu.au&d=DwMFaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=aVUTlDm-TpQmLPh8GYduaIdrwFkUij4wtBrv-X9yJz4&s=oyHoAo4mklGmb_jm-rzKYPvvofKEu68LWO4doCFkURg&e=>"
>> but that does work.
>>
>>
>>
>> If the user changes their DNS server to 8.8.8.8 or 1.1.1.1 then they do
>> get through.
>>
>>
>>
>> Problematic ISPs include:
>>
>>    Belong
>>
>>    Aussie Broadband
>>
>>    ...
>>
>> I've tried the frontline technical support numbers, but didn't make much
>> headway.
>>
>>
>>
>> Does anyone know how/why this DNS problems would be happening?
>>
>>
>>
>> Can some technical support people from ABB and Belong please contact me?
>>
>>
>>
>> Thanks,
>>
>>      John Mann
>>
>>      0419 568 470
>> This message contains information which may be confidential and
>> privileged. Unless you are the intended recipient (or authorized to receive
>> this message for the intended recipient), you may not use, copy,
>> disseminate or disclose to anyone the message or any information contained
>> in the message. If you have received the message in error, please advise
>> the sender by reply e-mail, and delete the message. Thank you very much.
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20181130/fecfcd00/attachment.html>