5

Recently we had to get some DDOS protection for our website because of the large attacks we were seeing after getting a bit of popularity.

We handed over our domain and hosting information to our DDOS protection provider. It worked perfectly but I have a question.

On our DNS records we have the Host and Answer and Type.

The host has our domain name there. The answer is this: SOMETEXTXXXX.dv.googlehosted.com.

And when I copy and paste it into my browser it gives me a 404 error. But our website still loads and functions as it should. I don't understand why it would need this?

I asked them about this and they said it is a method for DDOS protection and the other IPs are the reverse proxy (the other IPs give a 404 error too). Can anyone expand on this more please.

How does all this tie in together and make the internet browser know where to point the person with all these reverse proxies and stuff I don't understand.

Here is an image for reference: enter image description here

Improve this question
0

2 Answers 2

Reset to default
7

This is an old question but I recently ran into this issue and see that your question wasn't really answered. The *.dv.googlehosted.com CNAME record is for Google Apps, now known as GSuite, to verify your domain ownership.

I'm pretty sure it has nothing to do with DDOS protection, and is just so that Google can verify your domain name when you sign up for GSuite/Google Apps.

Improve this answer
2
  • 1
    Thanks for actually answering the question, as opposed to the other answer!
    – clayRay
    Commented Jun 9, 2021 at 5:31
  • 1
    Now known as Google Workspace haha
    – Brett
    Commented Apr 14, 2022 at 15:48
4

Here is what happens when a user makes a request to your site:

  1. They do a DNS lookup for yourdomain.example.com which tells them it is a CNAME of SOMETEXTXXXX.dv.googlehosted.com
  2. They do a DNS lookup for SOMETEXTXXXX.dv.googlehosted.com and get the IP address 192.0.2.4
  3. The browser opens a HTTP connection to 192.0.2.4 and sends the header: host: yourdomain.example.com
  4. The server at SOMETEXTXXXX.dv.googlehosted.com recognizes it as a request for yourdomain.example.com
  5. It checks that the request is not part of a denial of service.
  6. It opens an HTTP connection to your server and retrieves the page.
  7. It sends the page back to the client.

This DDOS prevention proxy is likely configured to serve multiple sites. That is why when you make a request at it with its own host name, you get a 404. In that case, it doesn't know where it should get the content from.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.