2

I have an issue that affects my websites which use .cf domains:
Since three days ago, my website visitors started complaining that the websites don't load on their devices. After doing a survey, about 50% of the visitors can't load the websites, and those visitors can't load any .cf website at all. The issue is clearly DNS resolution and it affects all .cf domains.

One way to see the issue is using this web service:
https://mxtoolbox.com/SuperTool.aspx?action=dns:dot.cf&newAppVersion=1

If you click on the "DNS Check" about 5-10 times, you'll see that at least some of the checks fail. Screenshot:

enter image description here

This is a serious issue that affects my visitors. Does anyone here have any information about the issue? I haven't found anything online. I didn't think I'd ever experience an issue which brings down a whole tld!

Except for changing the domain name, which I'm reluctant to do, is there anything else I can do?

1

DNSviz do not see big problems, just warnings: https://dnsviz.net/d/dot.cf/XnjMRg/dnssec/

enter image description here

It may have been transient. If you want to document it properly, your screenshot may not be enough. You should run dig commands towards each of the registry authoritative nameservers on .cf and record their reply for your domain.

In all cases like that, you have to contact the registry to ask them questions about their authoritative nameservers

This is a serious issue that affects my visitors.

If it is serious for you, you may need/want to start working on mitigating options as things like this can happen in all cases, but not all TLDs and registries are equal and the long term workaround is to make sure you have equivalent domains in other TLDs so that you can quickly switch to them in case of high damaging issue.

Because:

I didn't think I'd ever experience an issue which brings down a whole tld!

That did happen in the past. For various reasons. For example, once .DE had a problem generating its zonefile, and something like 30% of all domains in the TLD (and that TLD has a lot of them) just disappeared from the Internet.

|improve this answer|||||
  • "your screenshot may not be enough" - you can still reproduce it using the tool I linked – Paul Mar 23 at 17:24
  • "You should run dig commands towards each of the registry authoritative nameservers" - I tried using dig, but the thing is, it behaved differently on different machines. On some it worked properly, on some it timed out. – Paul Mar 23 at 17:25
  • @Paul the idea was more to tell you that the tool itself is not detailed enough. "Not able to get a response from some nameserver" is kind of useless if you do not know: what query was done precisely, from where, at which time, and to which nameserver. A tool like dnsviz or local dig commands will provide better hindsight if you need to really go to the bottom of it. – Patrick Mevzek Mar 23 at 17:26
  • "On some it worked properly, on some it timed out." Related or not I discovered in the past the these registries nameservers are not replying for some tests of mine, under UDP. But they work under TCP. Or sometimes with some +bufsize. I didn't contact them since I am not their client so I would have very low chance to be put in touch with some real technician on their side to discuss the gritty details of DNS. – Patrick Mevzek Mar 23 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.