今天為2020年1月1日。
為何用 DNS 8.8.8.8, 8.8.4.4 無法解釋 ithome.com.tw 域名 IP?
這個問題已經出現一個月了
我現在要用 DNS 1.1.1.1 才能正常運作。(用自建的DNS Server也正常)
有誰知道發生什麼事嗎?
香港寬頻 (Windows 10)
nslookup ithome.com.tw 8.8.8.8
伺服器: dns.google
Address: 8.8.8.8
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** 對 dns.google 的要求逾時
和記電訊 (Linux)
nslookup ithome.com.tw 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
** server can't find ithome.com.tw: SERVFAIL
中國移動 (Windows 7)
nslookup ithome.com.tw 8.8.8.8
伺服器: dns.google
Address: 8.8.8.8
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** 對 dns.google 的要求逾時
Traceroute Report
Result for ithome.com.tw/A with DNSSEC validation:
{
"Status": 2,
"TC": false,
"RD": true,
"RA": true,
"AD": false,
"CD": false,
"Question": [
{
"name": "ithome.com.tw.",
"type": 1
}
],
"Comment": "Name servers did not respond [220.130.119.129, 210.59.230.252]."
}
在上面的訊息顯示,"Name servers did not respond" <- 名稱服務器未響應
正常的話,應該是 "Comment": "Response from [220.130.119.129, 210.59.230.252]."
以下一個正常例子:
{
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": false,
"CD": false,
"Question": [
{
"name": "tophk.net.",
"type": 1
}
],
"Answer": [
{
"name": "tophk.net.",
"type": 1,
"TTL": 299,
"data": "210.3.122.66"
}
],
"Comment": "Response from 173.245.59.83."
}
先說ithome.com.tw這邊的問題,
(1) 上下層不一致
ns1 ns2 定義的NS IP, 跟com.tw這層定義的剛好對調, 所以並沒有影響解析, 但必須避免, 應立即修正.
(2) 2個authoritive dns資料不同調
各弄各的不累嗎? master/slave做zone transfer不就好了?
再說觀念問題,
會是ithome用了Bind view feature, 因應不同地區來回答查詢嗎?
如前面貼的討論, 已試過多個地區回應結果都相同, 應該是沒有.
造成這種現象的可能原因, 由於事發在香港, 我會優先懷疑DNS cache poisoning的可能性.(貼圖自APNIC blog)
鑑於DNS udp特性, 相關攻擊日益嚴重, 因此開始有改走 tcp/TLS/HTTPS 的計畫, 但目前仍在實驗階段且有爭議.
有興趣的邦友可以玩玩看 Firefox 的 DNS over HTTPS, 只需簡單設定就可體驗.
[參考]
我不知道發生什麼事
我用 8.8.8.8/1.1.1.1/168.95.1.1 的結果都一樣
C:\>nslookup
預設伺服器: dns.hinet.net
Address:
> server 8.8.8.8
預設伺服器: dns.google
Address: 8.8.8.8
> ithome.com.tw
伺服器: dns.google
Address: 8.8.8.8
未經授權的回答:
名稱: ithome.com.tw
Address: 220.130.119.130
> server 1.1.1.1
預設伺服器: one.one.one.one
Address: 1.1.1.1
> ithome.com.tw
伺服器: one.one.one.one
Address: 1.1.1.1
未經授權的回答:
名稱: ithome.com.tw
Address: 220.130.119.130
> server 168.95.1.1
預設伺服器: dns.hinet.net
Address: 168.95.1.1
> ithome.com.tw
伺服器: dns.hinet.net
Address: 168.95.1.1
未經授權的回答:
名稱: ithome.com.tw
Address: 220.130.119.130
就是奇怪,我用幾家ISP,都發現 8.8.8.8 有異常。
去 Google DNS 檢查也顯示一個異常 Comment:
Name servers did not respond [210.59.230.252, 220.130.119.129].
{
"Status": 2,
"TC": false,
"RD": true,
"RA": true,
"AD": false,
"CD": false,
"Question": [
{
"name": "ithome.com.tw.",
"type": 1
}
],
"Comment": "Name servers did not respond [210.59.230.252, 220.130.119.129]."
}
nslookup ithome.com.tw 8.8.8.8
伺服器: dns.google
Address: 8.8.8.8
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** 對 dns.google 的要求逾時
nslookup ithome.com.tw 1.1.1.1
伺服器: one.one.one.one
Address: 1.1.1.1
未經授權的回答:
名稱: ithome.com.tw
Address: 220.130.119.130
我使用 dig 來做測試,好做對照.
去 https://dns.google.com/ 檢查,出現異常。
我在香港也測試過幾家ISP,Google DNS 對 ithome.com.tw 也不能正常操作。沒法了,看來ithome.com.tw自己出了事也不知道。