[dns-operations] Things not to do -- anyone from iCIMS?

[Fred Morris]

This is probably not a good idea. I've noticed issues resolving stuff
served by them recently, but never put it together.

The thing that finally caught my attention was that e.g.

    # curl  https://careers-nv5.icims.com/jobs/intro
    curl: (6) Could not resolve host: careers-nv5.icims.com

and there is NO TRAFFIC after the DNS lookup.

--

Fred Morris, internet plumber

--

# dig careers-nv5.icims.com                        


; <<>> DiG 9.12.3-P1 <<>> careers-nv5.icims.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53003
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 4, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
; COOKIE: a4e0d692ceb3d7d5d1ee5b7d62d46623130178d66a21722c (good)
;; QUESTION SECTION:
;careers-nv5.icims.com.         IN      A

;; ANSWER SECTION:
careers-nv5.icims.com.  85383   IN      CNAME   wave3-prd.cloud.icims.tools.
wave3-prd.cloud.icims.tools. 143 IN     CNAME  
_dist-sdl-prd.cloud.icims.tools.
_dist-sdl-prd.cloud.icims.tools. 35 IN  A       65.8.66.20
_dist-sdl-prd.cloud.icims.tools. 35 IN  A       65.8.66.23
_dist-sdl-prd.cloud.icims.tools. 35 IN  A       65.8.66.30
_dist-sdl-prd.cloud.icims.tools. 35 IN  A       65.8.66.76

;; AUTHORITY SECTION:
cloud.icims.tools.      85384   IN      NS      ns-494.awsdns-61.com.
cloud.icims.tools.      85384   IN      NS      ns-860.awsdns-43.net.
cloud.icims.tools.      85384   IN      NS      ns-1160.awsdns-17.org.
cloud.icims.tools.      85384   IN      NS      ns-1961.awsdns-53.co.uk.

;; ADDITIONAL SECTION:
ns-494.awsdns-61.com.   171784  IN      A       205.251.193.238
ns-860.awsdns-43.net.   171784  IN      A       205.251.195.92
ns-1160.awsdns-17.org.  171784  IN      A       205.251.196.136
ns-1961.awsdns-53.co.uk. 1257   IN      A       205.251.199.169

;; Query time: 1 msec
;; SERVER: 10.0.0.220#53(10.0.0.220)
;; WHEN: Sun Jul 17 12:42:27 PDT 2022
;; MSG SIZE  rcvd: 415

****************

Yup, just to make sure it's not coming from the caching resolver:

****************

# dig @205.251.195.92 _dist-sdl-prd.cloud.icims.tools A +norecurse

; <<>> DiG 9.12.3-P1 <<>> @205.251.195.92
_dist-sdl-prd.cloud.icims.tools A +norecurse
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16963
;; flags: qr aa; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;_dist-sdl-prd.cloud.icims.tools. IN    A

;; ANSWER SECTION:
_dist-sdl-prd.cloud.icims.tools. 60 IN  A       13.224.2.84
_dist-sdl-prd.cloud.icims.tools. 60 IN  A       13.224.2.34
_dist-sdl-prd.cloud.icims.tools. 60 IN  A       13.224.2.46
_dist-sdl-prd.cloud.icims.tools. 60 IN  A       13.224.2.27

;; AUTHORITY SECTION:
cloud.icims.tools.      172800  IN      NS      ns-1160.awsdns-17.org.
cloud.icims.tools.      172800  IN      NS      ns-1961.awsdns-53.co.uk.
cloud.icims.tools.      172800  IN      NS      ns-494.awsdns-61.com.
cloud.icims.tools.      172800  IN      NS      ns-860.awsdns-43.net.

;; Query time: 35 msec
;; SERVER: 205.251.195.92#53(205.251.195.92)
;; WHEN: Sun Jul 17 13:10:33 PDT 2022
;; MSG SIZE  rcvd: 264