Domains blocked by Vultr cannot be resolved

[omata]

The minergate.com domain isn't returning any IP address. I did test others DNS servers and these returns the minergate.com IP addresses whit out issues.

Regards,

[ameshkov]

That's odd, I do see a response for minergate:

$ nslookup minergate.com 176.103.130.130
Server:     176.103.130.130
Address:    176.103.130.130#53

Non-authoritative answer:
Name:   minergate.com
Address: 136.243.102.154
Name:   minergate.com
Address: 136.243.102.167
Name:   minergate.com
Address: 94.130.143.162
Name:   minergate.com
Address: 88.99.142.163

[omata]

Same command but still with errors:

nslookup minergate.com 176.103.130.130                                                                                                                            ✓  10001  10:57:43
Server:     176.103.130.130
Address:    176.103.130.130#53

** server can't find minergate.com: SERVFAIL

[ameshkov]

@omata Could you plz show me the output of traceroute 176.103.130.130?

[ForkedLightning]

@ameshkov Just tested and it doesn't resolve for me. I'm using the Singapore server.

[ameshkov]

@ForkedLightning thx for checking!

[omata]

Redacted traceroute:

traceroute to 176.103.130.130 (176.103.130.130), 64 hops max, 52 byte packets
 1  000.000.000.000 (000.000.000.000)  1.713 ms  1.569 ms  1.665 ms
 2  * * *
 3  000.000.000.000 (000.000.000.000)  13.212 ms  32.258 ms  18.595 ms
 4  000.000.000.000 (000.000.000.000)  42.960 ms  62.558 ms  52.358 ms
 5  000.000.000.000 (000.000.000.000)  23.570 ms  80.504 ms  54.787 ms
 6  000.000.000.000 (000.000.000.000)  26.260 ms  89.161 ms  58.038 ms
 7  200.16.71.82 (200.16.71.82)  86.021 ms  75.920 ms  87.332 ms
 8  200.16.69.53 (200.16.69.53)  144.956 ms  85.831 ms  68.006 ms
 9  200.16.68.245 (200.16.68.245)  119.654 ms  102.476 ms  82.346 ms
10  * * *
11  vl23-br2.pnj1.choopa.net (66.55.130.53)  157.077 ms  82.010 ms  71.949 ms
12  ethernet1-2-2:1-c12-11-b5-2.pnj1.choopa.net (108.61.65.178)  65.178 ms  70.599 ms  112.315 ms
13  * * *
14  176-103-130-130.flops.ru (176.103.130.130)  122.622 ms  141.053 ms  99.260 ms

[ameshkov]

Thx, reproduced on both servers

[ameshkov]

Weird, it seems that this domain can't be resolved whichever DNS server I try from Vultr.com server (we use it as a hosting for most of the servers).

:~# nslookup minergate.com 208.67.222.222
;; connection timed out; no servers could be reached

:~# nslookup minergate.com 8.8.8.8
;; connection timed out; no servers could be reached

[omata]

It works for me from other DNS servers:

nslookup minergate.com 208.67.222.222                                                                                                                            
Server:     208.67.222.222
Address:    208.67.222.222#53

Non-authoritative answer:
Name:   minergate.com
Address: 136.243.102.167
Name:   minergate.com
Address: 94.130.143.162
Name:   minergate.com
Address: 136.243.102.154
Name:   minergate.com
Address: 88.99.142.163

nslookup minergate.com 8.8.8.8                                                                                                                                   
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   minergate.com
Address: 136.243.102.154
Name:   minergate.com
Address: 136.243.102.167
Name:   minergate.com
Address: 88.99.142.163
Name:   minergate.com
Address: 94.130.143.162

[ForkedLightning]

@ameshkov Vultr hates crypto currency miners and I hear they screw with customer's DNS packets. Maybe you need to send them angry support ticket or set up secondary resolver using dnscrypt for OpenDNS.

If dnscrypt doesn't resolve, then I now know who is screwing with my dnscrypt packets. (Dnscrypt for Singapore server still not working properly...but don't bother, I gave up.)

[ameshkov]

It works for me from other DNS servers:

The point is that I exec nslookup from the server console, and the server is hosted on Vultr.com.

If dnscrypt doesn't resolve, then I now know who is screwing with my dnscrypt packets. (Dnscrypt for Singapore server still not working properly...but don't bother, I gave up.)

We should anyway start providing DNS over TLS asap given that dnscrypt is no more maintained.

[ameshkov]

Vultr has confirmed that the issue is caused by their blocklist which is unfortunately dynamic so we don't know which domains are on the list.

The one we know for sure is minergate.com, we need to make sure that AdGuard DNS resolves it.