Service Unavailable Error

[Dave006]

It happened again about 8:59 PM. DNS servers 8.8.8.8 and 1.1.1.1 both report the correct address.

I did catch this error so looks like some part of the configuration of the hosting xenforo.cloud environment.

Dave

 

[Dave006]

I am now seeing 2 different IPs bouncing around the DNS Servers if I check often.


> disboards.com

Server: dnsr1.sbcglobal.net

Address: 68.94.156.1


Non-authoritative answer:

Name: disboards.com

Address: 108.171.164.208


> server 1.1.1.1

Default Server: one.one.one.one

Address: 1.1.1.1


> disboards.com

Server: one.one.one.one

Address: 1.1.1.1


Non-authoritative answer:

Name: disboards.com

Address: 108.61.75.210


Dave

 

[Wells Larsen]

It happened again about 8:59 PM. DNS servers 8.8.8.8 and 1.1.1.1 both report the correct address.

I did catch this error so looks like some part of the configuration of the hosting xenforo.cloud environment.

Dave

View attachment 685097

That's not a DNS error. That's and SSL Certificate Error.
Also, the likely reason that you are getting the error is because you are using "https://108.61.75.210", so although that is the correct address for the site, that is not what the certificate reads. It reads "disboards.com". The SSL handshake is not going to occur properly.

 

[Wells Larsen]

I am now seeing 2 different IPs bouncing around the DNS Servers if I check often.


> disboards.com

Server: dnsr1.sbcglobal.net

Address: 68.94.156.1


Non-authoritative answer:

Name: disboards.com

Address: 108.171.164.208


> server 1.1.1.1

Default Server: one.one.one.one

Address: 1.1.1.1


> disboards.com

Server: one.one.one.one

Address: 1.1.1.1


Non-authoritative answer:

Name: disboards.com

Address: 108.61.75.210


Dave

Those are just the DNS servers that your ISP uses. They are non-authoritative.
The authoritative ones are 162.159.26.131 and 162.159.27.117

Instead of executing nslookup disboards.com, do this instead

nslookup disboards.com ns87.worldnic.com
nslookup disboards.com ns88.worldnic.com

https://dnschecker.org/all-dns-records-of-domain.php?query=disboards.com&rtype=ALL&dns=google

 

[Dave006]

Those are just the DNS servers that your ISP uses. They are non-authoritative.
The authoritative ones are...

We know that but our client computers don't use those DNS servers. I am also seeing something odd based on what I perform a nslookup against.

disboards.com always appears to work for 108.61.75.210 but www.disboards.com seems to like to switch to Address: 108.171.164.208. The wrong IP from time to time.

Here is an example:

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address:
> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.171.164.208

Dave

 

[Wells Larsen]

We know that but our client computers don't use those DNS servers. I am also seeing something odd based on what I perform a nslookup against.

disboards.com always appears to work for 108.61.75.210 but www.disboards.com seems to like to switch to Address: 108.171.164.208. The wrong IP from time to time.

Here is an example:

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address:
> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.61.75.210

> www.disboards.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: www.disboards.com
Address: 108.171.164.208

Dave

Oh wow! Yea, that's odd. I just tried a reverse lookup on 108.171.164.208 and nothing was found.
That would certainly explain the site not available errors.
Orphan record on one of the DNS servers?

Or, maybe something more sinister? DNS Poisoning?
https://www.varonis.com/blog/dns-cache-poisoning#:~:text=Q: How Does DNS Cache,attackers choosing to steal data.

 

[Calantha]

Oh wow! Yea, that's odd. I just tried a reverse lookup on 108.171.164.208 and nothing was found.
That would certainly explain the site not available errors.
Orphan record on one of the DNS servers?

Yes, that one is coming out of Russia when I do a global DNS check...

 

[allaboutthemouse]

I have nothing to contribute because I am not tech savvy at all, just to add it’s been happening to me several times a day and is quite irritating. Thought it was just me until I found this thread…

 

[Dave006]

Oh wow! Yea, that's odd. I just tried a reverse lookup on 108.171.164.208 and nothing was found.
That would certainly explain the site not available errors.
Orphan record on one of the DNS servers?

It is not just one DNS server. I see it on multiple major servers that show 108.171.164.208 intermittently which is a major glitch for the Disboards.com forums.

Cloudflare - 1.1.1.1
Google - 8.8.8.8
AT&T - 68.94.156.1

A few don't seem to fail so far in my testing:

Level 3 - 4.2.2.1
Quad9 - 9.9.9.9
Cisco Cloud Umbrella Security - 208.67.222.222

Dave

 

[Wells Larsen]

It is not just one DNS server. I see it on multiple major servers that show 108.171.164.208 intermittently which is a major glitch for the Disboards.com forums.

Cloudflare - 1.1.1.1
Google - 8.8.8.8
AT&T - 68.94.156.1

A few don't seem to fail so far in my testing:

Level 3 - 4.2.2.1
Quad9 - 9.9.9.9
Cisco Cloud Umbrella Security - 208.67.222.222

Dave

Well, I mean isn't that how DNS Cache Poisoning works? It keeps spreading to all DNS Caches that request the lookup and you can't get rid of it until the TTL's expire.

 

[WebmasterAlex]

I just spent half an hour on the phone with them again and they swear it will be fixed in 4 hours. You'll have to excuse me for having doubts

 

[CarolMN]

Thanks for pushing them. Praying they figure this out soon!


Just got back on. Locked out since 10 pm Eastern last night. R/T Boards really backed up!

 

[DonMacGregor]

Thanks for pushing them. Praying they figure this out soon!


Just got back on. Locked out since 10 pm Eastern last night. R/T Boards really backed up!

That’s why I mentioned them before. All of those transactions are time sensitive and I can’t imagine how frustrating trying to negotiate a rental or trade would be if both parties kept getting booted intermittently.

 

[scrappinginontario]

Could this problem be related to no longer receiving emails for threads I'm watching? I stopped receiving those 2 or 3 days ago too.

 

[Dave006]

I just spent half an hour on the phone with them again and they swear it will be fixed in 4 hours. You'll have to excuse me for having doubts

Thanks for keeping us updated...

I am not sure it is their issue specifically just that it is a recent DNS change. Your other web content is very stable at https://www.wdwinfo.com

The root cause may be in the DNS prorogation scheme. It is very complex and one bad vendor's DNS Caching update mechanism could account for this behavior.

I am just glad it is not the move to XenFora forums causing the forums to lose content. I have seen that issue in the past with major fora migrations where every 3-4 hours all new posts where lost in the ether.

Dave

 

[Dave006]

Well, I mean isn't that how DNS Cache Poisoning works? It keeps spreading to all DNS Caches that request the lookup and you can't get rid of it until the TTL's expire.

It is not really poisoning the DNS since it is just the old IP keeping popping up. It is not a random hijack which would be a complete redirection to a malicious address.

More of a bug / human error in a very old but complex DNS scheme. Everyone starts pointing fingers up and down the chain.

Dave

 

[Wells Larsen]

That’s why I mentioned them before. All of those transactions are time sensitive and I can’t imagine how frustrating trying to negotiate a rental or trade would be if both parties kept getting booted intermittently.

Please don't take what I am about to say as "best practice", because it's not...
If it's absolutely important to have stability for transactions, you would be able to work around this particular issue by updating your local DNS Hosts file with the following (bypassing the need to DNS query/lookup a DNS Cache)

108.61.75.210 disboards.com

Location of hosts file on various operating systems

• Windows 10 - "C:\Windows\System32\drivers\etc\hosts"
• Linux - "/etc/hosts"
• Mac OS X - "/private/etc/hosts"

How to:
Editing a local hosts file on Windows 10

*Warning* - if the IP Address ever changed in the future and you had forgotten that you had made that entry, it might take you a long time to figure that out / troubleshoot it - That's why it's a horrible practice to do this.

 

[Wells Larsen]

It is not really poisoning the DNS since it is just the old IP keeping popping up. It is not a random hijack which would be a complete redirection to a malicious address.

More of a bug / human error in a very old but complex DNS scheme. Everyone starts pointing fingers up and down the chain.

Dave

Gotcha. I didn't realize it was the old IP Address. I guess I thought someone had said that the IP originated in Russia. Sorry for my confusion.

 

[DonMacGregor]

Could this problem be related to no longer receiving emails for threads I'm watching? I stopped receiving those 2 or 3 days ago too.

Dunno, but I’m kinda glad they stopped. Deleting 40 or 50 emails every day gets old.

 

[CarolMN]

Could this problem be related to no longer receiving emails for threads I'm watching? I stopped receiving those 2 or 3 days ago too.

Might be. I tried to use my phone to access the DIS using data instead of wi-fi and never got the email with the code (for two-step authentication).