Networking
Post #5784 · source on Telegram
It Was DNS Again
Description
A pale orange meme image with a faint shield-like background contains large centered white text: "It's not DNS", "There is no way it's DNS", "It was DNS.", and the attribution "-Unknown wise person". The visual is simple and text-first, using the familiar escalating denial format. The technical context is the recurring operations reality that name resolution, caching, propagation, split-horizon configuration, or stale records often explain failures that initially look like application bugs. It is especially relatable to engineers who have lost hours debugging services before checking DNS.
More like this
More like this in Networking →
Use J and K for navigation
Comments
29Comment deleted
DNS is the distributed system everyone debugs last and unknowingly depends on first.
What? Comment deleted
Eat some shit, MS Comment deleted
wtf? Comment deleted
Fuckers Comment deleted
What the actual fuck? Comment deleted
it is real? Comment deleted
I mean I have a subdomain that points to one of my local devices IPs but what is that? Like does anybody know a reasoning behind what ms did? Comment deleted
My isp doesn’t allow me to ping my own ip using my own ip. So thats why Comment deleted
So you don’t know why and what this causes but it’s because Microsoft is shit? Comment deleted
Good for you ig Comment deleted
they did revert this Comment deleted
Can anybody explain what it means for someone not so close to the internals of the Internet? Comment deleted
Microsoft added locally-routable (LAN) addresses to their public (WAN) domain names, so that people trying to visit Microsoft website or other network services are directed to their own (not Microsoft's) local adresses, resulting in long timeouts and "Could not establish a connection" errors. Comment deleted
define "their" microsoft or people? Comment deleted
Thanks Geniuses Comment deleted
Bruh but wouldn’t devices be smart enough to connect to another ip? Isn’t that the point of having multiple ips for the same domain? Comment deleted
This is a legitimate question, based on my assumption. Comment deleted
Yes, they ultimately would, but not before waiting for the timeout on the first address being tried (DNS records are returned in round-robin fashion, so only a fraction of users would be affected by such misconfigurations), but it is of course application-specific — some applications may want to try alternative addresses after a very short delay, such as in IPv6 to IPv4 fallback. Comment deleted
Ah okay good to know Comment deleted
So if I put multiple IPs onto the same domain it would basically be random who uses which ip? And I would assume that 30 min timeout is when the cache is dropped? Comment deleted
Yes, it is usually random, but depends on caching — both on intermediate DNS servers (resolvers) and clients, which in turn may exercise their own policy on record ordering. You may set record expiration time (for re-querying) for the entire zone and per record, but that is only informational for the users — each party may choose to ignore original setting at least to some extent, such as establishing their own minimum and maximum time-to-live. Comment deleted
I see would the cache be renewed while in use? Like suddenly an xhr would go to another server? Comment deleted
Normally, the caching is controlled by Refresh (soft) and Expire (hard) limits setglobally for zone, but also by an optional per-record TTL: my.zone IN SOA ns.icann.org. noc.dns.icann.org. ( 2020.... ; Serial 7200 ; Refresh 3600 ; Retry 1209600 ; Expire 3600 ; Negative caching ) microsoft.com 3600 IN A 192.168.1.1 But the actual use of this data is totally consumer-dependent. It may stick to the same IP address to avoid routing and firewalling issues, as well as to simultaneously use all available addresses to distribute the load and lower the risk of "unlucky" choice. Comment deleted
In Armenia there's a thing with some taxes related government service, it has 2 A-records. The 1st one points to a local IP in the dev team network, the 2nd to an actual public backend. So you either have to hardcode the public one in your hosts file locally or just spam refreshes until you get lucky and round-robin hits the public IP. Comment deleted
Even funnier is that they got like hundreds of complaints, but just answered that that's a feature and they do not plan to change it. Comment deleted
; <<>> DiG 9.18.21 <<>> api.workpermit.am ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10557 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;api.workpermit.am. IN A ;; ANSWER SECTION: api.workpermit.am. 300 IN A 192.168.3.30 api.workpermit.am. 300 IN A 83.139.47.27 Comment deleted
The bundled ms-office online and for Android is so buggy, I switched back to cryptpad Comment deleted
Alright, that's why i use other subnet. Suck ms Comment deleted