DNS Resolution Issue

[MHM2]

This is odd, but it may be a host issue.

Trying to resolve gate.polarhome.com fails with different results
depending upon geography. Using the same DNS servers, This is a no-ip
host, name server likely to be ns2.no-ip.com, but should rarely change.
The resolved IP addresses are Bigpond owned.

BigPond ADSL (dynamic ip 120.153.0.1) using 61.9.194.49 61.9.195.193
$ host gate.polarhome.com
gate.polarhome.com has address 61.9.195.209
gate.polarhome.com has IPv6 address 2001:8002:e22:f002::f5ff
Host gate.polarhome.com not found: 3(NXDOMAIN)

Bigpond Cable (quasi-static ip 121.211.230.227) using 61.9.194.49
61.9.195.193
$ host gate.polarhome.com
gate.polarhome.com has address 61.9.194.18
gate.polarhome.com has IPv6 address 2001:8002:e21:f002::f5ff
Host gate.polarhome.com not found: 3(NXDOMAIN)

-----------expected correct results below----------

AWS using DNS 172.31.0.2
$ host gate.polarhome.com
gate.polarhome.com has address 83.251.229.229
gate.polarhome.com has IPv6 address 2001:470:dce3::100

Google using DNS 8.8.8.8 8.8.4.4
$ host gate.polarhome.com
gate.polarhome.com has address 83.251.229.229
gate.polarhome.com has IPv6 address 2001:470:dce3::100

Because the bad resolves are BP and different, I am thinking there is a
dead end somewhere ?

[Yastiandrie]

Resolves just fine from what i can see

DNS Propagation Checker

nschtcdns31 Chatswood (NSW) (61.9.194.49)	gate.polarhome.com. 60 IN A 83.251.229.229
nschtcdns32 Chatswood (NSW) (61.9.194.49)	gate.polarhome.com. 60 IN A 83.251.229.229
nschtcdns33 Chatswood (NSW) (61.9.194.49)	gate.polarhome.com. 60 IN A 83.251.229.229
nskencdns31 Kent St (NSW) (61.9.195.193)	gate.polarhome.com. 60 IN A 83.251.229.229
nskencdns32 Kent St (NSW) (61.9.195.193)	gate.polarhome.com. 60 IN A 83.251.229.229
nskencdns33 Kent St (NSW) (61.9.195.193)	gate.polarhome.com. 60 IN A 83.251.229.229
qlchacdns31 Charlotte St (QLD) (61.9.211.33)	gate.polarhome.com. 60 IN A 83.251.229.229
qlchacdns32 Charlotte St (QLD) (61.9.211.33)	gate.polarhome.com. 60 IN A 83.251.229.229
qlchacdns33 Charlotte St (QLD) (61.9.211.33)	gate.polarhome.com. 60 IN A 83.251.229.229
qlwoocdns31 Woolloongabba (QLD) (61.9.211.1)	gate.polarhome.com. 60 IN A 83.251.229.229
qlwoocdns32 Woolloongabba (QLD) (61.9.211.1)	gate.polarhome.com. 60 IN A 83.251.229.229
qlwoocdns33 Woolloongabba (QLD) (61.9.211.1)	gate.polarhome.com. 60 IN A 83.251.229.229
saflicdns31 Flinders St (SA) (61.9.226.33)	gate.polarhome.com. 60 IN A 83.251.229.229
saflicdns32 Flinders St (SA) (61.9.226.33)	gate.polarhome.com. 60 IN A 83.251.229.229
sawaycdns31 Waymouth (SA) (61.9.226.1)	gate.polarhome.com. 60 IN A 83.251.229.229
sawaycdns32 Waymouth (SA) (61.9.226.1)	gate.polarhome.com. 60 IN A 83.251.229.229
viloncdns31 Lonsdale St (VIC) (61.9.133.193)	gate.polarhome.com. 60 IN A 83.251.229.229
viloncdns32 Lonsdale St (VIC) (61.9.133.193)	gate.polarhome.com. 60 IN A 83.251.229.229
viloncdns33 Lonsdale St (VIC) (61.9.133.193)	gate.polarhome.com. 60 IN A 83.251.229.229
viwincdns31 Windsor (VIC) (61.9.134.49)	gate.polarhome.com. 60 IN A 83.251.229.229
viwincdns32 Windsor (VIC) (61.9.134.49)	gate.polarhome.com. 60 IN A 83.251.229.229
viwincdns33 Windsor (VIC) (61.9.134.49)	gate.polarhome.com. 60 IN A 83.251.229.229
wapiecdns31 Pier St (WA) (61.9.242.1)	gate.polarhome.com. 60 IN A 83.251.229.229
wapiecdns32 Pier St (WA) (61.9.242.1)	gate.polarhome.com. 60 IN A 83.251.229.229
wawelcdns31 Wellington St (WA) (61.9.242.33)	gate.polarhome.com. 60 IN A 83.251.229.229
wawelcdns32 Wellington St (WA) (61.9.242.33)	gate.polarhome.com. 60 IN A 83.251.229.229

[MHM2]

OK, fair enough. So now I am wondering if this is being filtered (i.e. blacklisted) regardless of the above results? My failures (NXDOMAIN) are only for Telstra cable and ADSL, and do not seem related to OS, Router, Modem. I can override with "hosts", but would rather not.

[Yastiandrie]

I couldn't see any indication of blacklisting.

There was another thread where there was a similar issue being reported recently but he was with a different host. Again my propagation checks resolves the correct address when i check (during the day at least)

If the issue persists on both counts I may be able to send it through to Network Services and Facilities for investigation

[MHM2]

Thank you for that, I know it is a different animal entirely but I don't have an issue with mobile data (Telstra) using 10.4.27.70 and 10.5.133.45.

[joranvds]

We are having the exact same issue here with the domain sendabasket.com.au

It reports correctly from every other DNS service, however anyone with Telstra Cable/ADSL is getting the incorrect info below in the screenshot.

Telstra phone support is not able to help as they dont understand the issue.

Incorrect from telstra DNS, and correct from google DNS

[gavincostello]

I can reach both of these sites with no issue on BigPond connection via 61.9.195.209
I can also confirm that they're not being filtered on that connection.

[mazinoz]

I'm also able to load the page, but due to Chrome's changes I had to enter the address as a https://www.sendabasket.com.au
I did not use a VPN to connect to page. I'm having problems with my VPN working with Chrome.

[Yastiandrie]

Pages do load fine for me, but pings traceroutes and nslookups seem to resolve to what I assume is one of the load balancer IP's for the DNS servers

Interesting enough the on the polarhome site there's also a section which I assume is displays the public IP of the computer visiting it. It also returns the same IP that that nslookup does for the website itself. Almost acting like a proxy

[Yastiandrie]

Hi all,
I've received a response as to why this behaviour exists and it affects customers that have Telstra Broadband Protect on their accounts (it's generally a freebie with plans these days)

The results goes through the resolver on the DNS and the returned IP is a proxy used as part of TBP (I figure the Network Protection Component which is always active in some way). They are working on solutions to this so its more clear to the end user. The website itself should still load as normal in a browser, unless its part of TBP malicious content blacklist. In which cause you would effectively end up either blocked from the site or, if you have turned down the Network Protection settings in myaccount, will get a 'proceed' button

Basically from what i've gathered, if you get TBP removed from your account pings/traceroutes/nslookups/digs should return the correct address. Alternatively adjusting the Primary/Secondary DNS will achieve the same result

@mazinoz is going to love this one

[MHM2]

Thanks for this.  It explains a lot. 

Disabling and re-enabling TBP is not trivial though, not like a dashboard control.or a whitelist.

The "proceed" button might be useful for browsers, but not for Telnet, SSH, IOT, cURL, FTP, reverse DNS, and so on. Turning down protection effectively does nothing then. Even more so for people resolving from their gateway.

I'll watch this space.

[Yastiandrie]

Correct. Getting TBP removed general involves a call to billing as it can't be self-serve done