I’m on at least 2 blocklists at this point for the crime of not having reverse DNS set up. I don’t know how rDNS works. No amount of reading Wikipedia is helping me understand what I have to do.
- I have a domain at a registrar which gives me bog standard DNS.
- I have Apache running on my network.
- I have PiHole running on my network.
My understanding is that rDNS is not set up at my registrar, but somewhere in my network. What do I do?
Thank you for your time.
I would love to tell you why they do this, but I can’t. I can only tell you that they tell me it’s because I don’t have rDNS
These guys are blocking me http://www.uceprotect.net/en/rblcheck.php “Level 1 HIGH DNS problem WARNING: No Reverse-DNS (PTR) is assigned to your IP”
These guys are blocking a friend of mine who has the same setup as me https://matrix.spfbl.net " No rDNS was found. This IP has been flagged because have none valid FCrDNS. Register a valid rDNS for this IP, which points to the same IP. The rDNS must be registered under your own domain for you be able to delist it."
Are you sending email from your ip?
If not this is irrelevant. Those block lists are only for email related spam filtering.
If you are, don’t send email from a home isp
No emails just routing issues.
Copy pasted but I have routing issues that neither my ISP nor the people who suffer from it can pinpoint. I’m so far down this rabbit hole that I’m assuming my IP got on a blacklist that’s sitting on some random networking infrastructure and I’m just trying to resolve all blacklist issues on the off chance that it works.
Blacklists are not your problem.
I’m listening to your suggestions.
Ugh, uceprotect is the worst of the worst with overly strict rules to encourage paying them to whitelist your IP. Just ignore them.
I want to, but I have routing issues that neither my ISP nor the people who suffer from it can pinpoint. I’m so far down this rabbit hole that I’m assuming my IP got on a blacklist that’s sitting on some random networking infrastructure and I’m just trying to resolve all blacklist issues on the off chance that it works.
DNSBL as result of lack of rDNS isn’t going to affect routing. Can you perhaps describe exactly what you’re having, and maybe we can figure out the solution together?
I would pay you money if you can fix this issue.
A number of people can’t route to me at all. My domain is drkt.eu and sits on port 80 and 443 @ 89.150.135.135 and 2a05:f6c7:8039::1337
IPv6 is not big in my country, and I don’t think anyone afflicted has IPv6 so I can’t tell you if this affects both v4 and v6.
It’s not a DNS issue, as the afflicted users can get the correct IPs from nslookup.
Mullvad VPN users are consistently unable to route to me.
One friend can’t route to me from his workplace network. It’s a small network and their admin claims they don’t block anything so it’s a mystery to him as well.
Another friend across town can’t reach my network despite being so close to me hop-wise, but his network is run by wacks and is consequently also quite wack. I can’t confidently say this is the same issue.
I’m not dropping any connections for any reason. My ISP claims they aren’t doing any blocking of domains or IPs.
Traceroutes time out at consistent hops but it’s different per afflicted network. The only recurring name has been costumer.tdc.net
It might not be related, but I can’t route to catbox.moe and their admin says my IPs are not blacklisted in any of their systems.
What’s your input?
You are correct; looking at the resolutions via Google’s toolbox, it seems to be resolving fine.
I did a couple of traceroute tests from a couple locations (two data centres, my local WiFi, and via cellular data), and they all seem to end at
cpe.ae20-0.khk7nqp8.dk.customer.tdc.net. In teleco terms,cpeusually means “Client/Customer Premise Equipment”, so it wouldn’t surprise me if that is the address assigned to the network equipment closest to your server’s local network (think neighborhood hub, or PON on premise, something super close to the demarcation point). If everyone else is able to get that far, then I’m more inclined to think the drop is happening on your equipment, not your ISP’s equipment; but having said that, if this is a residential network (regardless if ISP is provisioning you gigabit connectivity via fibre or whatever), there will always be a likelihood for ISP to be doing more filtering.If you don’t mind, what is the gateway you’re using? Is there an ISP gateway and then your own, or straight from ISP equipment into your network? Are there any (single/double) NAT going on? Are there’s any security/filtering options on (either) equipment(s)?
I have an ISP issued fiber modem that goes straight into my pfsense box. For IPv4 I have NAT and Firewall, for v6 it’s just the firewall. It should be noted that I’ve been hosting with this setup for years and it wasn’t a problem until I got this ISP at this location. I’ve had this ISP elsewhere without problems and another ISP here where it also wasn’t a problem.
The traceroutes getting dropped was a misconfiguration in my firewall on my part, it should work now!
My friend across town can now ping me successfully but going to my website still gives him ERR_CONNECTION_TIMED_OUT in browser.
EDIT ----------
I got another troublesome user to run a quick test with the new firewall config. Also can’t reach my website. Pings DO time out for him! Traceroute expectedly also fails, last hop was cpe.ae20-0.khk7nqp8.dk.costumer.tdc.net [87.61.121.169]
From my side, I now see 3
???s between the CPE and your IP address, which is also responding, so that’s great.Can your friend do something like
curl -vvv https://drkt.euor whatever to see if the time out happens before/after SSL handshake etc.? Also, do they have any firewalls / security appliances configured to filter content? I’d be curious to seedigornslookupresult,pingortracerouteresult, andcurl -vvvresult, just to understand where it is breaking down.Also, do you have a login to your ISP’s equipment? Are you able to set it to bridge mode to bypass it altogether? Just throwing ideas out there, to see if there is anything else on the go. That
cpedevice is also pretty curious for sure.Edit: Also, if they can get a response from ping, then it is probably not routing, but something else on the connection to the service / port itself. That’s what I’m hoping we can figure out from the various outputs.
Office friend still can’t ping me. The campus friend can ping me but can’t reach my website. I never trusted campus friend to be on a clean network so it’s a bit fruitless to test his connection.
My ISP’s equipment is entirely a modem right now, bridging straight to my pfsense router. It’s not doing any weird filtering.
Here are the results of those from office friend
Server: unifi.localdomain Address: 192.168.0.1 Non-authoritative answer: Name: drkt.eu Addresses: 2a05:f6c7:8039::1337 89.150.135.135 Tracing route to drkt.eu [89.150.135.135] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms unifi.localdomain [192.168.0.1] 2 1 ms <1 ms <1 ms 5.186.33.65.static.fibianet.dk [5.186.33.65] 3 4 ms 4 ms 3 ms 89.150.66.104 4 4 ms 4 ms 4 ms ae2.core01-tkbg.bb.fibianet.dk [89.150.64.25] 5 * * * Request timed out. 6 3 ms 3 ms 3 ms 89.150.69.66 7 2 ms 4 ms 2 ms 217.74.211.104 8 3 ms 4 ms 4 ms 194.182.97.132 9 4 ms 4 ms 3 ms ae22-0.khk7nqp7.dk.ip.tdc.net [195.215.109.46] 10 4 ms 4 ms 4 ms ae1-0.khk7nqp8.dk.ip.tdc.net [83.88.12.15] 11 3 ms 4 ms 4 ms cpe.ae20-0.khk7nqp8.dk.customer.tdc.net [87.61.121.169] 12 * * * Request timed out. 13 * * * Request timed out. 14 * * * Request timed out. 15 * * * Request timed out. 16 * * * Request timed out. 17 * * * Request timed out. 18 * * * Request timed out. 19 * * * Request timed out. 20 * * * Request timed out. 21 * * * Request timed out. 22 * * * Request timed out. 23 * * * Request timed out. 24 * * * Request timed out. 25 * * * Request timed out. 26 * * * Request timed out. 27 * * * Request timed out. 28 * * * Request timed out. 29 * * * Request timed out. 30 * * * Request timed out. Trace complete. * Rebuilt URL to: https://drkt.eu/ * Trying 89.150.135.135... * TCP_NODELAY set * connect to 89.150.135.135 port 443 failed: Timed out * Failed to connect to drkt.eu port 443: Timed out * Closing connection 0 curl: (7) Failed to connect to drkt.eu port 443: Timed out— UPDATE
Office friends pinged me 4 times, all timed out on his end. His IP showed up in my state table and I captured these 2 packets
State table:
Interface Protocol Source -> Destination State Packets Bytes WAN icmp 5.186.33.87:1 -> 89.150.135.135:1 0:0 4 / 4 240 B / 240 BPacket capture:
(the only 2, despite the 4 pings, and they have bad checksums?)All 8 expected packets show up but all do have bad checksums. I’m seeing a LOT of bad checksums. A known working connection from fourth friend did not show bad checksums in this same test.5.186.33.87 > 89.150.135.135: ICMP echo request, id 1, seq 43476, length 40 12:38:19.843890 d0:50:99:81:48:17 > 4c:6d:58:4a:97:d4, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 21715, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->1dc0)!) 89.150.135.135 > 5.186.33.87: ICMP echo reply, id 1, seq 43476, length 40 12:38:20.219177 d0:50:99:81:48:17 > 4c:6d:58:4a:97:d4, ethertype IPv4 (0x0800), length 43: (tos 0x0, ttl 64, id 32958, offset 0, flags [none], proto ICMP (1), length 29, bad cksum 0 (->3f6d)!)Not sure if any seasoned sysadmin actually use uceprotect blocklist in their network though, so you shouldn’t lose sleep over that one.
Some light reading related to uceprotect:
uceprotect.wtf is amazing, thank you
Depending on your isp, you may be required to have a business class plan with a static ip. I went through something similar years ago for my business. This is old documentation for Verizon, but it’s a hint.
https://community.verizon.com/t5/Fios-Internet-and-High-Speed/How-to-make-reverse-DNS-point-to-my-own-domain/td-p/1376002