Cloudflare is resolving the incorrect DNS for archive.today again | Hacker News Reader

Cloudflare is resolving the incorrect DNS for archive.today again

4 pointsTrouble_0075 comments

  dig archive.today @1.1.1.1 returns - SOA carl.archive.is. admin.archive.today.

--> Tell HN: Archive.* Is Unavailable : https://news.ycombinator.com/item?id=35749833

Title edited

View on HN

A couple of issues with the title. The 1st is that archive.* not resolving isn't accurate. archive.today and the other domains associated with it such as archive.is fail to resolve. archive.org which is not associated resolves fine. The same for archive.us (a parked domain). Also the title implies the issue is with Cloudflare when the issue is archive.today refusing to answer dns requests from Cloudflare.

Edited Title to reflect archive.(today|is|li|vn|fo|md)

archive.today resolves correctlly from other DNS providers, it is just Cloudflare resolving incorrectly.

Cloudflare strips the edns info from requests. Edns contains the IP address of the client making the request. Cloudflare strips it for privacy reasons. archive.today has an issue with this and therefore refuses to answer dns requests from Cloudflare. According to archive.today this is because not having the requesting IP address prevents them from complying with per country requirements. But archive.today will happily reply to dns requests from other resolvers which don't include the edns info. You can test this yourself using dig with the +noedns flag.

This would seem like a childish dispute, and if you follow my previous postings on this subject,

you would see Cloudflare resolved to 1.1.1.(4|6|7|8) all Cloudflare IPs, not an IP that archive.today would provide

Archive.is have a history of blocking CF as CF do not pass EDNS Client-Subnet data. I think that blocking CF is an odd choice given that sending EDNS Client-Subnet data is entirely optional.

As a work-around one could use Google or OpenDNS or others listed below:

    8.8.8.8, 8.8.4.4, 208.67.222.222, 208.67.220.220, 149.112.112.112

There are a few DoT/DoH/QUIC servers [1][2] if anyone is using Unbound on their home network or wish to edit their browser settings. The equivalent command for dig with DoT is kdig, available in the knot-utils package.

    kdig @37.252.231.163 +tls-ca +tls-host=open.dns0.eu +noall +answer archive.is
    archive.is.          300 IN A 185.101.35.175

[1] - https://dnsprivacy.org/public_resolvers/

[2] - https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...

Reply on news.ycombinator.com