<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>You are seeing the effect of DNS Injection in China. </div>
<div><br>
</div>
<div>Here are good write-ups: <a href="http://dnssec.vs.uni-due.de/dnsinjection/">http://dnssec.vs.uni-due.de/dnsinjection/</a> and <a href="http://www.sigcomm.org/node/3275">http://www.sigcomm.org/node/3275</a></div>
<div>
<div><br>
</div>
<div>In any case, the .com/.net nameservers are not authoritative for <a href="http://cs216.wpc.edgecastcdn.net">cs216.wpc.edgecastcdn.net</a>. You will never get an A record (in the answer section) from gtld-servers.net nameservers.</div>
<div><br>
</div>
<div></div>
</div>
</div>
</div>
<div>- Matt</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Shawn Hsiao <<a href="mailto:phsiao@tripadvisor.com">phsiao@tripadvisor.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, January 8, 2015 at 8:49 AM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:dns-operations@dns-oarc.net">dns-operations@dns-oarc.net</a>" <<a href="mailto:dns-operations@dns-oarc.net">dns-operations@dns-oarc.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [dns-operations] issue with m root server from China?<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
</div>
<div>Looks like more than just m root servers.</div>
<div><br>
</div>
<div>From a handful of Catchpoint monitoring nodes in Beijing.</div>
<div><br>
</div>
<div><a href="http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-Ie-I301-jR.BWB_P8Lf-AV0AR0-jR.BWB_P8Lf-tau">http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-Ie-I301-jR.BWB_P8Lf-AV0AR0-jR.BWB_P8Lf-tau</a> (Beijing, CN - AWS, got response directly from <a href="http://h.gtld-servers.net">h.gtld-servers.net</a>)</div>
<div><a href="http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-HQ-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau">http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-HQ-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau</a> (Beijing, CN - CERNET, got response directly from <a href="http://k.gtld-servers.net">k.gtld-servers.net</a>)</div>
<div><a href="http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-HB-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau">http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-HB-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau</a> (Bejing, CN - China Mobile, got response directly from <a href="http://b.gtld-servers.net">b.gtld-servers.net</a>)</div>
<a href="http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-BH-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau">http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-BH-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau</a> (Beijing, CN - Telecom, got response directly from <a href="http://h.gtld-servers.net">h.gtld-servers.net</a>)
<div><a href="http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-GU-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau">http://p.catchpoint.com/ui/Entry/PW/I/DFl-tau-GU-I316-jR.BWB_QiRB-AV0AR0-jR.BWB_QiRB-tau</a> (Beijing, CN - Unicom, got response directly from <a href="http://g.gtld-servers.net">g.gtld-servers.net</a>)</div>
<div><br>
</div>
<div><br>
<div><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>---</div>
<div>// Shawn</div>
<div><br>
</div>
</div>
</span><br class="Apple-interchange-newline">
</span><br class="Apple-interchange-newline">
</div>
<br>
<div>
<div>On Jan 8, 2015, at 8:37 AM, Shawn Hsiao <<a href="mailto:phsiao@tripadvisor.com">phsiao@tripadvisor.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
</div>
<div>We have reports that some qnames are not resolving properly in China, and in two of the follow ups I have received it appears they are getting random responses directly from the m root server. Not sure what is causing it, but I am wondering if someone
on the list knows.</div>
<div><br>
</div>
<div>So far, I am only aware this happening to <a href="http://edgecastcdn.net/">
edgecastcdn.net</a> domain, and other domains we tested are resolving fine.</div>
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div>(from a home computer)</div>
<div>$ dig +trace <a href="http://cs216.wpc.edgecastcdn.net/">cs216.wpc.edgecastcdn.net</a><br>
<br>
; <<>> DiG 9.8.3-P1 <<>> +trace <a href="http://cs216.wpc.edgecastcdn.net">cs216.wpc.edgecastcdn.net</a><br>
;; global options: +cmd<br>
. 23964<br>
IN NS<br>
<a href="http://j.root-servers.net">j.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://i.root-servers.net">i.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://g.root-servers.net">g.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://f.root-servers.net">f.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://m.root-servers.net">m.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://h.root-servers.net">h.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://e.root-servers.net">e.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://c.root-servers.net">c.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://a.root-servers.net">a.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://l.root-servers.net">l.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://k.root-servers.net">k.root-servers.net</a>.<br>
. 23964<br>
IN NS<br>
<a href="http://b.root-servers.net">b.root-servers.net</a>.<br>
. 23964<br>
IN NS <a href="http://d.root-servers.net">d.root-servers.net</a>.<br>
;; Received 228 bytes from 192.168.1.1#53(192.168.1.1) in 12 ms<br>
<br>
<a href="http://cs216.wpc.edgecastcdn.net">cs216.wpc.edgecastcdn.net</a>. 2732 IN A 206.17.103.24<br>
<b>;; Received 84 bytes from 202.12.27.33#53(202.12.27.33) in 100 ms</b><br>
<br>
</div>
<div><br>
</div>
<div>(from a server in a datacenter)</div>
<div>$ dig +trace <a href="http://cs216.wpc.edgecastcdn.net/">cs216.wpc.edgecastcdn.net</a><br>
<br>
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4 <<>> +trace <a href="http://cs216.wpc.edgecastcdn.net">cs216.wpc.edgecastcdn.net</a><br>
;; global options: +cmd<br>
.<br>
498401 IN<br>
NS <a href="http://b.root-servers.net">b.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://i.root-servers.net">i.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://c.root-servers.net">c.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://a.root-servers.net">a.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://l.root-servers.net">l.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://j.root-servers.net">j.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://e.root-servers.net">e.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://m.root-servers.net">m.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://g.root-servers.net">g.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://k.root-servers.net">k.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://h.root-servers.net">h.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://d.root-servers.net">d.root-servers.net</a>.<br>
.<br>
498401 IN<br>
NS <a href="http://f.root-servers.net">f.root-servers.net</a>.<br>
;; Received 508 bytes from 192.168.4.192#53(192.168.4.192) in 8419 ms<br>
<br>
<a href="http://cs216.wpc.edgecastcdn.net">cs216.wpc.edgecastcdn.net</a>. 1911<br>
IN A<br>
54.210.250.207<br>
<b>;; Received 59 bytes from 202.12.27.33#53(202.12.27.33) in 3 ms</b></div>
<br>
<div><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>---</div>
<div>// Shawn</div>
<div><br>
</div>
</div>
</span><br class="Apple-interchange-newline">
</span><br class="Apple-interchange-newline">
</div>
<br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>