Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 123 posts

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#111

Post by cryptonector »

mike_d wrote: post #98
Yeri wrote: post #84

(CF TAM here) All plans come with support. Even the free plans (community, or email, the bot will deflect the request but if you email you're still stuck, you will get a reply _eventually_ (due to heavy support load, it can take a while though). The correct procedure would be: * turn off DNSsec on old registrar (and wait a day or two) * update NS and/or migrate domain * wait a while and make sure it works * turn on D…

The correct steps are to completely disable DNSSEC and remove the relevant records. It is far too fragile for the majority of use cases. Effort should instead be put into deploying things like DNSCrypt that implement transport security and confidentiality. Transport security is like HTTPS. DNSSEC was the equivalent of PGP signing every webpage. The former brings value to the end user, the latter not so much. Even the…

I want both, DNSSEC and DNSCrypt.

WebPKI is a joke because it lacks name constraints and so isn't and can't be hierarchical. DNSSEC is a true PKI -- you can still have multiple roots if you like and don't trust ., but it's got name constraints, so whatever domain you graft an alternate PKI at, from there on down you get bound to that PKI. This is really, truly fantastic.

Add DANE and you have a complete replacement for WebPKI.

DNSCrypt is needed to increase confidentiality, it's cheaper than DNSQuic and such things. Unfortunately .'s and com's and major TLDs' NSes are unlikely to want to waste CPU cycles on any DNS confidentiality solution, and even if some TLDs did, unless clients use QName minimization, users gain no confidentiality -- . and the TLDs all have to adopt it.

The two, together, would be truly fantastic.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#112

Post by cryptonector »

mike_d wrote: post #110
mike_hearn wrote: post #106

Earlier quoted context omitted.

DNSSEC is however the only way you can make TLS really work. The whole TLS ecosystem is dependent on CAs that are basically just a giant hack. They're signing a statement that they did a bunch of DNS resolutions at a point in time from different network vantage points (maybe, hopefully), and got consistent answers. DNSSEC+DANE lets you get the actual data you want (domain name->public key binding) from the root sourc…

DNSSEC+DANE is an affirmation by the United States government that you have followed a chain to an answer about a certificate pinning. Handshake (www.handshake.org, Trigger warning: crypto) will give you what you are talking about (CA non-reliance) anchored in the owner of the website itself. If you aren't a fan of DV certificates (as you point out verified by resolution), you can always restrict your trust store to…

The root zone doesn't change often. You can pin . or even run your own private . with pinned . content if you don't trust the root.

If you do, then you get MITM protection.

If you don't, but choose to use QName minimization, you still get a modicum of MITM protection: because the attacker would have to choose to get in the middle without having enough knowledge of whether a particular upcoming TLS connection (or whatever) will be of particular interest.

Really, DNSSEC is infinitely better than the WebPKI, even WebPKI+CT, especially when DNSSEC clients use QName minimization, and even more so when clients pin copies of . from time to time.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#113

Post by paulnpace »

snowwrestler wrote: post #107
paulnpace wrote: post #68

Earlier quoted context omitted.

> DNSSEC is notorious for breaking things My understanding is that people break things.

Sure, everyone makes mistakes, but there’s still a difference between juggling rubber balls and juggling knives.

But I have seen professional knife jugglers, and none made a mistake.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#114

Post by juliancox »

jgrahamc wrote: post #75
ejjpi wrote: post #73

I'm also noticing that Cloudflare support is going terribly downhill. I have an issue with the Cloudflare infrastructure on my domain since WEEKS, giving me thousands of 503 Service Temporarily Unavailable errors per day (cloudflare side, not the origin server) and nobody seems to care or able to resolve. Removing the ability to create support tickets on free plan doesn't help at all, I mean, I get it why they're doi…

Can you email me (jgc@cloudflare.com) with details?

I can also confirm the support seems to be terrible at the moment, which is disappointing as in general I think cloudflare is a great service and I've had good experiences with most of the features (though the docs often leave a bit to be desired) and have been a user since cloudflare's early beta days.

We're on a pro plan and have had an outstanding support ticket since March 22nd. With the last cloudflare response being 19 days ago.

I can't seem to get cloudflare to talk directly to backblaze (it's a domain mapping issue) and playing the middle-man in a back and forth between cloudflare and backblaze support seems to be recipe for not getting things resolved promptly.

I know it's covid times and organizations may be short staffed but compare this to cloud66 support who implemented a whole code update to support a special edge case for a non-paying customer within 48 hours. That makes an almost 2 month old unresolved ticket seem a bit tired.

@jgrahamc I'll email you ticket details in case you'd like to take a look.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#115

Post by paulnpace »

ceejayoz wrote: post #105
_wldu wrote: post #101

Earlier quoted context omitted.

So when organizations hire people that do not understand the DNS or PKC to maintain their DNS then it is the organization's fault (rather than the person who made the change). I accept that and agree.

But if a bunch of large, well-staffed, engineering-focused, otherwise competent organizations manage to fuck it up regularly, the problem's probably above the individual organizations. Potentially with the spec itself.

I've seen far more failed certificate renewal failures than DNSSEC failures from the same teams you appear to be suggesting are perfect and the standard is flawed.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#116

Post by neurostimulant »

warrenm wrote: post #91
the8472 wrote: post #14

Earlier quoted context omitted.

From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites. And as you mentioned we need to update certs, webservers and DNS all the time to keep up to date. We only put up with it because it protects users from from snoopers. But that means we live in an inadequate equilibrium. If we abolished mass surveillance rather than i…

> From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites Sorry, but this argument doesn't hold water And this coming from someone who supports systems still running NT 4 I have fallback rules enabled on all of my domains - TLS 1.3 is preferred, but older editions will be supported if the need arises (1.2, 1.1, and 1.0 (on…

If your service must meet some strict certifications (e.g. PCI DSS), simply enabling old tls/ssl protocols for backward compatibility is not an option.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#117

Post by InitialBP »

Sorry to hear about your problem, a quick recommendation would be to keep the temporary DNS name you bought and simply redirect to your previous name once you have the issue resolved (or vice versa if the branding is less important to you.) This way your users won't need to know or care about the change anymore aside from this temporary setback.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#118

Post by quinncom »

elithrar wrote: post #3

(It sucks that I had to see this on HN) Can you email me - silverlock at cloudflare - with your ticket ID and domain name so I can understand what broke?

Is there a way to pay for priority support while on a free plan?

I'm nervous about migrating a domain to CF which is used for glue records, and want to have immediate support access if something goes wrong.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#119

Post by elithrar »

quinncom wrote: post #118
elithrar wrote: post #3

(It sucks that I had to see this on HN) Can you email me - silverlock at cloudflare - with your ticket ID and domain name so I can understand what broke?

Is there a way to pay for priority support while on a free plan? I'm nervous about migrating a domain to CF which is used for glue records, and want to have immediate support access if something goes wrong.

The $20/mo Pro plan includes formal support (one of the big perks of Pro!)

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#120

Post by juliancox »

juliancox wrote: post #114
jgrahamc wrote: post #75

Earlier quoted context omitted.

Can you email me (jgc@cloudflare.com) with details?

I can also confirm the support seems to be terrible at the moment, which is disappointing as in general I think cloudflare is a great service and I've had good experiences with most of the features (though the docs often leave a bit to be desired) and have been a user since cloudflare's early beta days. We're on a pro plan and have had an outstanding support ticket since March 22nd. With the last cloudflare response…

I'm pleased to say that my problem has been promptly resolved now as well.
Post reply on HN