DNS not resolving only for a handful of people – after 10 days and even via Google DNS

cloudflaredns

I have a new website and its DNS entry (thetunegame.com) is now 10 days old, so it should have propagated properly.

I've had over 200 people from several countries accessing it with no issues, however there are 4 people, all from Greece (although this could be a sample bias), who can't access it. One sent me this screenshot:

enter image description here

I understand this means their system can't find a DNS entry. I'm not an expert and this is not my own system, so I'm limited as to what I can do, however I have ascertained that:

  1. Changing to Google DNS servers (and doing ipconfig /flushdns) does not solve it
  2. Changing network does solve it
  3. Not all 4 people are on the same network/ISP (therefore it's not an issue with a particular ISP)
  4. Changing browser does not solve it (in case it was a Chrome caching issue)

My set up:

  • Google-registered domain, pointing to Cloudflare DNS
  • Cloudflare has DNSSEC enabled (in case that matters)

Things I've tried:

  • Asking the people who have this issue to do the things described above
  • Test the DNS resolves OK for me and for servers around the world via several online tools (it does)
  • Checked the DNSSEC settings between Google and Cloudflare are consistent

I'm completely stuck! I can't understand how 4 people (not on the same network) can't see it, even when trying via Google DNS servers.

I have no idea what else to test, in case it's something wrong with my setup.

Is there a way of confirming that my setup is correct?

And if it is, what else can I ask these people to try?

Best Answer

Checked the DNSSEC settings between Google and Cloudflare are consistent

They are not. The delegation you submitted through Google specified an RSA key (algorithm 5), but the actual zone at Cloudflare is using an ECDSA P-256 key (algorithm 13).

You can see the DNSSEC validation status at DNSViz: original scan, latest scan.

Algorithm mismatch makes signatures impossible to verify, so people using validating resolvers will get a SERVFAIL error while non-validating resolvers have no issues with the domain. The Google public resolver (8.8.8.8) is a validating one.

To fix this, change the DNSSEC settings at Google to specify ECDSA P-256 (13) as the algorithm. You may need to wait up to 24 hours for the old DS records to expire from caches. (DNSViz will bypass caching and will see the changes sooner, but you have to click "Update now" to refresh the diagram.)

1 (The shown key size of 512 bits is normal for an EC P-256 key.)

Related Question