6 ms·

Well one of my domains resolves to some dodgy russian website when using cloudflare's dns. I did everything in my power, including trying to contact them, but i

Well one of my domains resolves to some dodgy russian website when using cloudflare's dns. I did everything in my power, including trying to contact them, but it still resolves to the russian host. On any other dns server it resolves correctly to gandi's parking page. Cloudflare did send me an email within 10 seconds to say that no support ticket can/will be logged since I'm not a paying customer (or just customer on their system) and that they case is closed. i get it, but it's still a nasty feeling. And yes I did use their dns flusher, it didn't help. I switched all my networks back to google's dns.

BatteryMountain 5y ago
And the reason why it pissed me off was, I thought my mikrotik router or raspberry pi + pihole got compromised. I spent two hours trying to track down the problem, reset all dns setting on gandi, resetting and updating the router etc... just to find that it worked fine on my phone on MNO's network...then I digged further and found if I switch my dns to anything other than 1.1.1.1, it worked fine. So I don't care what features they are flinging at this point, dns being hijacked is no good.
- bennyp101 5y ago
  That seems less "sticking to principles" and more "we aren't resolving correctly, but can't/won't tell you why?"
- tinus_hn 5y ago
  If you are using dnssec this should be impossible, right?
- dhaavi 5y ago
  Just tweet at the 1.1.1.1 account, it‘ll resolve for you on Twitter. ;P See https://twitter.com/1111Resolver https://twitter.com/1111Resolver
runlevel1 5y ago
That's an odd problem. A few possible causes jump to mind: A. Someone is poisoning it between you and Cloudflare, but only for DNS requests directed towards Cloudflare. B. Someone is poisoning it between Cloudflare and Gandi. C. Someone was able to trick Cloudflare into thinking it is the authoritative DNS provider and its authoritative DNS servers are the same ones as its recursive resolvers. D. Something got missed in troubleshooting. (Not trying to be a jerk, it's just always a possibility.) You could probably surface whether it's A or B by playing around with DNSSEC. I'm not certain, but you might be able to figure out if it's C with this: https://rdap.cloudflare.com https://rdap.cloudflare.com
zenexer 5y ago
This is a very serious security issue if the cause is on Cloudflare’s end. Would you be willing to disclose the domain name?
jgrahamc 5y ago
I am Cloudflare's CTO. Email is jgc@cloudflare. Please email me and let me know what domain is involved so I can investigate.

BatteryMountain 5y ago

And the reason why it pissed me off was, I thought my mikrotik router or raspberry pi + pihole got compromised. I spent two hours trying to track down the problem, reset all dns setting on gandi, resetting and updating the router etc... just to find that it worked fine on my phone on MNO's network...then I digged further and found if I switch my dns to anything other than 1.1.1.1, it worked fine. So I don't care what features they are flinging at this point, dns being hijacked is no good.

bennyp101 5y ago
That seems less "sticking to principles" and more "we aren't resolving correctly, but can't/won't tell you why?"
tinus_hn 5y ago
If you are using dnssec this should be impossible, right?
dhaavi 5y ago
Just tweet at the 1.1.1.1 account, it‘ll resolve for you on Twitter. ;P See https://twitter.com/1111Resolver https://twitter.com/1111Resolver

runlevel1 5y ago

That's an odd problem. A few possible causes jump to mind: A. Someone is poisoning it between you and Cloudflare, but only for DNS requests directed towards Cloudflare. B. Someone is poisoning it between Cloudflare and Gandi. C. Someone was able to trick Cloudflare into thinking it is the authoritative DNS provider and its authoritative DNS servers are the same ones as its recursive resolvers. D. Something got missed in troubleshooting. (Not trying to be a jerk, it's just always a possibility.) You could probably surface whether it's A or B by playing around with DNSSEC. I'm not certain, but you might be able to figure out if it's C with this: https://rdap.cloudflare.com https://rdap.cloudflare.com

zenexer 5y ago

This is a very serious security issue if the cause is on Cloudflare’s end. Would you be willing to disclose the domain name?

jgrahamc 5y ago

I am Cloudflare's CTO. Email is jgc@cloudflare. Please email me and let me know what domain is involved so I can investigate.