Log in Get started
Changelog ·

Bad DNS records named, not mistaken for outages

A site whose DNS also carries an unreachable address is checked on its public one and gets a warning; a zone whose DNSSEC fails is told so instead of «does not resolve».

probesmonitors

Since 18:33 UTC, every probe runs agent 2.10.2, with two changes that came from one hoster's sites today.

A name whose DNS has a public address and also one the internet can't reach (a link-local fe80::, a private range, loopback or carrier-grade NAT) is now checked on its public address and shown as a warning, «IPv6 record unusable: fe80::… is link-local», instead of as down. The monitor page says why it matters: visitors whose devices try that record first may not reach the site. Before, such a site showed Down while it opened fine in a browser.

A name that doesn't resolve is now asked again with DNSSEC checking off. If it answers then, the reason reads «DNSSEC validation fails for (resolvers that validate, such as Google and Quad9, refuse it)» rather than «does not resolve». The site really is unreachable for those visitors, and now the message says what to fix: the zone's signatures, or the DS record at the registrar. Because other resolvers still answer, such a site usually sits in Unconfirmed, and since 18:26 UTC an Unconfirmed monitor shows where and why it fails, e.g. «11 of 20 locations: DNSSEC validation fails for …», in the monitor list and on the dashboard.

Details in How a check works.

← All updates