Telstra DNS Blocking

[holidaytown]

I am trying to get to bottom of Telstra DNS resolver not finding fairbreak.net.

The problem appeared out of the blue on 29 January and has meant the site has not been accessible to people using the Telstra mobile network.

The common error message has been ERR_NAME_NOT_RESOLVED.

The site had been running through Cloudflare. Investigations identified Telstra IPs periodically have problems reaching Cloudflare sites. I could not identify reasons for or resolution of those problems.

However, in case this was what was happening, I disabled Cloudflare and repointed the domain to the site’s origin host server. DNS checks show resolution has occurred everywhere else but Telstra, even with TTL set at a low value. This continuing inaccessibility has been affecting site reputation with Telstra users.

The trace route command using a Telstra IP shows:

......

>tracert fairbreak.net

Unable to resolve target system name fairbreak.net

...

A ping test against the domain also does not work:

...

>ping fairbreak.net

Ping request could not find host fairbreak.net. Please check the name and try again.

....

However a ping test against the site's known origin host works just fine, so the IP is not blocked.

What is the fix for this please Telstra? 

[Jupiter]

Some of the duration settings are rather long, which may be affecting the usual 48 hour DNS update cycle.

TTL is set at minimum 86400 (24 hours) and expiry 1209600 (2 weeks), refresh is 3600.

The settings I use are TTL minimum 10800 (3 hours) and expiry 604800 (1 week), refresh is 10800. Never had a problem with not being found by DNS.

[holidaytown]

Thanks, I will adjust those settings.

In the meantime the site remains not found via the Telstra network, but is accessible by all other avenues.  Beats me why that is the case and how anyone would get through to anyone in Telstra with the level of access to find out if some block is in place, and why...

[Yastiandrie]

Its not blocked

Have sent it to DNS team to investigate

[Yastiandrie]

Apologies the site has been malware flagged. Other vendors have also flagged it:

https://www.virustotal.com/gui/url/a560dbe12f4ddba162e3f855e4022d5270d601e7c3580ae1e808f839e14afad5/...

In the meantime it might pay to get the site  checked out and cleaned, then posting or PM'ing me an update as well as engaging the vendors listing it as malicious on the above link and requesting re-assessment

Will let you know if i get an update as to what exactly is triggering it

[holidaytown]

Hello

Thanks. What does Telstra use as its authoritative source about malware? I see the site is listed by only two engines in the list provided out of about 76 engines.  Surely that should not cause it be blocked by Telstra and no others?

In any event, it is unclear to us:

 - why the site became impossible to find via Telstra network on 29 January (and still not found via Telstra) but has not been a problem to access via any other network, when no changes to the site were made

- even if there is malware (which we will investigate, but don't believe), why does attempted access via the Telstra network return 'ERR_NAME_NOT_RESOLVED' (ie, it cannot even resolve the domain name to its host server 65.60.7.28), instead of giving some 'BEWARE MALWARE' response?

We do know that when using the Telstra network we can ping that host server IP address, so the server is not blocked, but only the Telstra DNS continues to appear unable to resolve the domain name to that server, for reasons we do not understand, but it remains a problem.

Any light you can shed on this problem appreciated.

[Yastiandrie]

I don't have the authority to give out vendor information but they are a well known entity.

They have come back and advised it was a false positive and have whitelisted the site so it should be accessible again for Telstra customers. Honestly I'd never seen this level of network protection before.

[holidaytown]

Hello

Many thanks for chasing this through.

Can you say how long whitelisting takes to take effect? I have just tried myself to access via Telstra network after flushing device cache but still getting a: "This site can't be reached - the server IP address could not be found - ERR_NAME_ NOT_RESOLVED" response.

I note the external provider reports it was a false positive problem.  If that is the case it is pretty poor that such a situation has led to our site being inaccessible since 29 January.

[Yastiandrie]

I got informed at 19:40 AEST(QLD), not long before I posted the update. Not sure how long it all takes to filter through

[holidaytown]

Hello

Thanks for that update. Note we have been in touch with each of the vendors that showed a negative report through virustotal.com. Each of them have reviewed the site and found it clean, actually without anything being done to the site, suggesting they were all false-positives, to our disadvantage. See this latest Virustotal report: https://www.virustotal.com/gui/url/a560dbe12f4ddba162e3f855e4022d5270d601e7c3580ae1e808f839e14afad5/...

However, the site remains inaccessible via Telstra network, we continue to get a ERR_NAME_NOT_RESOLVED response, and we are convinced it remains a problem with the Telstra DNS and its ability to resolve fairbreak.net, for these reasons:

1. When fairbreak.net is pinged via the Telstra network, the following reponse is received suggesting to us the Telstra DNS simply fails at the first hurdle in resolving the domain name against its host server (65.60.7.28):

>ping fairbreak.net

Ping request could not find host fairbreak.net. Please check the name and try again.

2. The host server itself can be pinged no problem via the Telstra network, so it is not blocked, suggesting again the Telstra DNS simply can't connect the domain name with its host server.

3. We attempted to ping the Telstra DNS IPs found at this link (https://dnschecker.org/dns/Australia) and in every case they timed out.  Even when pinged via the Telstra network.  Why are they timing out? For example:

>ping 61.9.194.49

Request timed out.

Request timed out.

Request timed out.

Request timed out.

Ping statistics for 61.9.194.49:

    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

4. We then pinged other competitor DNS IPs found at the same link, using the Telstra network, and none of them timed out. So what is wrong with the Telstra DNS? For example:

>ping 211.29.132.12

Pinging 211.29.132.12 with 32 bytes of data:

Reply from 211.29.132.12: bytes=32 time=11ms TTL=56

Reply from 211.29.132.12: bytes=32 time=11ms TTL=56

Reply from 211.29.132.12: bytes=32 time=12ms TTL=56

Reply from 211.29.132.12: bytes=32 time=10ms TTL=56

Ping statistics for 211.29.132.12:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 10ms, Maximum = 12ms, Average = 11ms

After now 12 days with the site still not being found via the Telstra network, we are at our wit's end in trying to get this sorted out.  Again, for example, the site shaunmartynassociates.com is also hosted at 65.60.7.28 and there is no problem reaching that via the Telstra network. The problem remains specifically having the Telstra DNS resolve fairbreak.net to that same host server. 

We do thank you for your own guidance and assistance, since we cannot find any other way in to Telstra for someone to even look at this.

[Jupiter]

It can take up to 48 hours for the DNS records to update across the world. So it shouldn't take longer than tomorrow night to resolve if the whitelisting was successful.

[holidaytown]

The site remains inaccessible via the Telstra network since 29 January but is available through others, and has been since that time.

The browser error message remains the same: ERR_NAME_NOT_RESOLVED

The site still cannot be pinged via the Telstra network: "Ping request could not find host fairbreak.net."

We remain unconvinced there is not a problem or some kind of block on the Telstra DNS preventing it resolving to the site's host server.

It would seem quite ridiculous that site accessibility has been suffering via the Telstra network alone for 13 days now without resolution.

We are taking steps via other Telstra management channels to have this matter examined.

[Mkrtich]

Hi - in case this adds to the puzzle -   I am located in Brisbane on different Telstra DNS Servers to you and when I attempt to connect to fairbreak.net through the Edge Browser, I get no connection Unable to Connect blockage. About 10 seconds later, an Avast window pops on my desktop up advising it has placed that site on a blacklist as it has detected malware on it. Could be a false positive and offers a scan of the PC to see any others exist - you may wish to send Avast an email to clarify their classification. 

[holidaytown]

OK thanks for that info, will look into it.

In the meantime, still getting ERR_NAME_NOT_RESOLVED response via Telstra network.

At the least the response you got is more intelligible and allows for directed follow-up action than the Telstra DNS returning responses that it cannot even resolve the domain name.

In the meantime the virustotal.com scan continues to show the site as clean.

https://www.virustotal.com/gui/url/a560dbe12f4ddba162e3f855e4022d5270d601e7c3580ae1e808f839e14afad5/...

[holidaytown]

In response to Jupiter

Two weeks further on this site remains inaccessible via the Telstra network without explanation or resolution.

This is damaging to the business. What on earth can be done to correct why the Telstra DNS cannot resolve the domain name fairbreak.net to its origin server at 65.60.7.28?

The site continues to be clean via virustotal.com:

[holidaytown]

In response to Jupiter

See clean site results at:

https://www.virustotal.com/gui/url/a560dbe12f4ddba162e3f855e4022d5270d601e7c3580ae1e808f839e14afad5/...

[Mkrtich]

Hi - another jigsaw piece,  I can access your web site from my iPhone, using Aldi powered by Telstra 4G LTE which I think uses IPv6 protocol. 

[Jupiter]

I suspect you are using a different DNS server than actual Telstra services use.

I still can't see it through my Telstra mobile.