<div><br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 22, 2021 at 7:26 PM Adam David <<a href="mailto:adam.vallee@gmail.com">adam.vallee@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">This does not seem to be a DNS resolution/misconfiguration issue on Cloudflare's end. <br><br><a href="https://172.64.80.1/" target="_blank">https://172.64.80.1/</a> provides an error message (as it should) indicating it is a CloudFlare IP. If you can't see that in a web browser, then the issue is local to your network. </div></blockquote><div dir="auto"><br></div><div dir="auto">Yes, 172.64.80.1 is a CF address, but it was being returned for <a href="http://deltamath.com">deltamath.com</a>.</div><div dir="auto">Doing a GET / over TLS with the host set to <a href="http://deltamath.com">deltamath.com</a> was <span style="color:rgb(49,49,49);font-size:1rem;word-spacing:1px">giving a 403 Forbidden:</span></div><div dir="auto"><div style="font-size:1rem;color:rgb(49,49,49);word-spacing:1px" dir="auto">HTTP/1.1 403 Forbidden<br>Server: cloudflare<br>Date: Wed, 22 Sep 2021 18:44:15 GMT<br>Content-Type: text/html<br>Content-Length: 151<br>Connection: keep-alive<br>CF-RAY: 692daefc1ffd542b-YYZ<br><br><html><br><head><title>403 Forbidden</title></head><br><body><br><center><h1>403 Forbidden</h1></center><br><hr><center>cloudflare</center><br></body><br></html></div></div><div dir="auto"><br></div><div dir="auto">The other address handed out all worked fine.</div><div dir="auto">So:</div><div dir="auto">1: it is a DNS issue and they shouldn’t have handed out that address for that name or</div><div dir="auto">2: that machine was borked.</div><div dir="auto"><br></div><div dir="auto">W</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><br></div><div>The main causes that I gather would be:<br><br>1. There was a temporary cache propagation issue on CF's network. (Still not a DNS issue.)<div>2. Your IT department is using <a href="http://172.0.0.0/9" target="_blank">172.0.0.0/9</a> or possibly even <a href="http://172.0.0.0/8" target="_blank">172.0.0.0/8</a> where they intended to use <a href="http://172.16.0.0/12" target="_blank">172.16.0.0/12</a> (RFC1918 IP space). This would block access to the netblock belonging to Cloudflare and you would have difficulty accessing thousands of websites.</div><div> Side Note: <a href="http://172.64.0.0/13" target="_blank">172.64.0.0/13</a> belongs to AS13335.<br></div><div><br></div><div>You should always start with your IT department.<br>If you are a Cloudflare customer, contact them directly.</div><div>If you are a DeltaMath customer, then you need to contact them directly.<br></div><div><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><br></div><div><span style="font-family:arial">Sincerely,</span><br></div><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-family:arial;font-size:small"><br></div><div style="font-family:arial;font-size:small">Adam Vallee</div><div style="font-family:arial;font-size:small"><br></div></div></div></div></div></div></div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 22, 2021 at 4:03 PM Brown, William <<a href="mailto:wbrown@e1b.org" target="_blank">wbrown@e1b.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">From: dns-operations <<a href="mailto:dns-operations-bounces@dns-oarc.net" target="_blank">dns-operations-bounces@dns-oarc.net</a>> On Behalf Of Erik Stian Tefre<br>
Sent: Wednesday, September 22, 2021 3:38 PM<br>
To: <a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
Subject: Re: [dns-operations] Oddness with Cloudfare authoritative servers<br>
<br>
> Possibly not a DNS issue at all, but something like this:<br>
<br>
> <a href="https://community.cloudflare.com/t/revil-ransomware/301435" rel="noreferrer" target="_blank">https://community.cloudflare.com/t/revil-ransomware/301435</a><br>
<br>
> (Executive summary: One Cloudflare IP being blocked by a firewall because of a different and misbehaving Cloudflare customer who happened to serve malicious content from that same IP.)<br>
<br>
> Regards,<br>
> Erik<br>
<br>
Interesting. The real issue I am experiencing is that I am getting inconsistent responses from nominally the same authoritative server. It just so happens that when we get 172.64.80.1 as the answer it fails. I would prefer to get the correct answer so students can use the online educational resource the district is paying for.<br>
Confidentiality Notice: This electronic message and any attachments may contain confidential or privileged information, and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agent responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachments. Please notify the sender immediately by return e-mail or telephone and delete this message from your system.<br>
<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Perhaps they really do strive for incomprehensibility in their specs.<br>After all, when the liturgy was in Latin, the laity knew their place.<br>-- Michael Padlipsky<br></div></div>