dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1180
share rss forum feed


NetFixer
From my cold dead hands
Premium
join:2004-06-24
The Boro
Reviews:
·Cingular Wireless
·Comcast Business..
·Vonage
·Comcast

[DNS] Comcast DNSSEC problems?

While troubleshooting what appeared to be DNS anomalies on my network, I got these results from the ICSI Netalyzr test and the GRC DNS benchmark test (the GRC test was configured to test DNSSEC responses).







Normally, all of the Comcast 75.75.x.x and 68.87.x.x servers shown in the GRC test above return a good DNSSEC response, but at this time only the 75.75.76.76 and 68.87.74.162 servers appear to be working correctly.

Summary: Basic DNS resolution from the Comcast servers seems to be working OK, but there appears to be a problem with DNSSEC compliance. FWIW, this was not causing the problem I was troubleshooting (that was a fat finger error I made in my local DNS server), but it did surprise me since normally I pass the DNSSEC tests.
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.


ctg1701a
VIP
join:2008-08-07
Media, PA

said by NetFixer:

While troubleshooting what appeared to be DNS anomalies on my network, I got these results from the ICSI Netalyzr test and the GRC DNS benchmark test (the GRC test was configured to test DNSSEC responses).

Normally, all of the Comcast 75.75.x.x and 68.87.x.x servers shown in the GRC test above return a good DNSSEC response, but at this time only the 75.75.76.76 and 68.87.74.162 servers appear to be working correctly.

Summary: Basic DNS resolution from the Comcast servers seems to be working OK, but there appears to be a problem with DNSSEC compliance. FWIW, this was not causing the problem I was troubleshooting (that was a fat finger error I made in my local DNS server), but it did surprise me since normally I pass the DNSSEC tests.

Could you provide a traceroute to both 75.75.75.75 and 75.75.76.76 please? We will take a look at the resolvers you are pointed to once we know which Anycast nodes you are pointed to.

Thank you

Chris
Comcast


NetFixer
From my cold dead hands
Premium
join:2004-06-24
The Boro
Reviews:
·Cingular Wireless
·Comcast Business..
·Vonage
·Comcast

1 edit

said by ctg1701a:

Could you provide a traceroute to both 75.75.75.75 and 75.75.76.76 please? We will take a look at the resolvers you are pointed to once we know which Anycast nodes you are pointed to.

Thank you

Chris
Comcast

Thanks for the reply, but today the Comcast DNSSEC servers that I use are once again properly responding to DNSSEC queries:







However, here are the traceroute results to the servers that I use if that will help with any post mortem exam you decide to do:



C:\>tracert 75.75.75.75
 
Tracing route to cdns01.comcast.net [75.75.75.75]
over a maximum of 30 hops:
 
  1    31 ms    30 ms    15 ms  174.49.8.1
  2    12 ms     8 ms     8 ms  xe-4-0-0-0-sur02.murfreesboro.tn.nash.comcast.net [68.85.50.129]
  3    24 ms    11 ms     9 ms  xe-2-1-1-0-ar01.goodslettvll.tn.nash.comcast.net [68.86.176.53]
  4    22 ms    19 ms    22 ms  pos-5-4-0-0-cr01.56marietta.ga.ibone.comcast.net [68.86.90.189]
  5    19 ms    18 ms    18 ms  so-7-1-0-0-ar01.b0atlanta.ga.atlanta.comcast.net [68.86.93.206]
  6    21 ms    20 ms    20 ms  te-8-3-ur01.s3ndigital.ga.atlanta.comcast.net [68.86.107.18]
  7     *       19 ms    20 ms  cdns01.comcast.net [75.75.75.75]
 
Trace complete.
 
C:\>tracert 75.75.76.76
 
Tracing route to cdns02.comcast.net [75.75.76.76]
over a maximum of 30 hops:
 
  1    37 ms    30 ms    29 ms  174.49.8.1
  2    25 ms     8 ms     9 ms  xe-4-0-0-0-sur02.murfreesboro.tn.nash.comcast.net [68.85.50.129]
  3    10 ms     9 ms    11 ms  xe-2-1-1-0-ar01.goodslettvll.tn.nash.comcast.net [68.86.176.53]
  4    18 ms    22 ms    19 ms  pos-5-4-0-0-cr01.56marietta.ga.ibone.comcast.net [68.86.90.189]
  5    42 ms    42 ms    41 ms  68.86.95.222
  6    41 ms    41 ms    40 ms  po-12-ur01.greenspoint.tx.houston.comcast.net [68.85.244.150]
  7     *       41 ms    40 ms  cdns02.comcast.net [75.75.76.76]
 
Trace complete.
 
C:\>tracert 68.87.68.162
 
Tracing route to nrcns.s3woodstock.ga.atlanta.comcast.net [68.87.68.162]
over a maximum of 30 hops:
 
  1    36 ms    29 ms    29 ms  174.49.8.1
  2     9 ms     9 ms     8 ms  xe-4-0-0-0-sur02.murfreesboro.tn.nash.comcast.net [68.85.50.129]
  3    11 ms    11 ms    11 ms  xe-5-1-3-0-ar01.goodslettvll.tn.nash.comcast.net [68.86.176.105]
  4    22 ms    36 ms    19 ms  pos-5-5-0-0-cr01.56marietta.ga.ibone.comcast.net [68.86.90.101]
  5    18 ms    18 ms    20 ms  so-7-1-0-0-ar01.b0atlanta.ga.atlanta.comcast.net [68.86.93.206]
  6    19 ms    19 ms    18 ms  te-8-1-ur01.s3ndigital.ga.atlanta.comcast.net [68.85.109.218]
  7    21 ms    20 ms    20 ms  nrcns.s3woodstock.ga.atlanta.comcast.net [68.87.68.162]
 
Trace complete.
 
C:\>tracert 68.87.72.130
 
Tracing route to nrcns.area4.il.chicago.comcast.net [68.87.72.130]
over a maximum of 30 hops:
 
  1    31 ms    11 ms    21 ms  174.49.8.1
  2    10 ms     9 ms     9 ms  xe-4-0-0-0-sur02.murfreesboro.tn.nash.comcast.net [68.85.50.129]
  3    11 ms    12 ms    11 ms  xe-2-1-1-0-ar01.goodslettvll.tn.nash.comcast.net [68.86.176.53]
  4    20 ms    19 ms    19 ms  pos-5-6-0-0-cr01.56marietta.ga.ibone.comcast.net [68.86.90.89]
  5    33 ms    35 ms    35 ms  68.86.87.113
  6    36 ms    35 ms    35 ms  he-2-13-0-0-ar01.elmhurst.il.chicago.comcast.net [68.86.94.102]
  7    33 ms    33 ms    47 ms  te-9-4-ur04.area4.il.chicago.comcast.net [68.87.210.2]
  8     *        *        *     Request timed out.
  9     *       32 ms    33 ms  chic-cns.area4.il.chicago.comcast.net [68.87.72.130]
 
Trace complete.
 
C:\>tracert 68.87.74.162
 
Tracing route to nrcns.bonitasprngs.fl.naples.comcast.net [68.87.74.162]
over a maximum of 30 hops:
 
  1    24 ms    27 ms    19 ms  174.49.8.1
  2     9 ms     9 ms     9 ms  xe-4-0-0-0-sur02.murfreesboro.tn.nash.comcast.net [68.85.50.129]
  3    10 ms    12 ms    43 ms  xe-5-1-3-0-ar01.goodslettvll.tn.nash.comcast.net [68.86.176.105]
  4    22 ms    19 ms    20 ms  pos-5-6-0-0-cr01.56marietta.ga.ibone.comcast.net [68.86.90.89]
  5    25 ms    22 ms    23 ms  british-cr01.mclean.va.ibone.comcast.net [68.86.89.62]
  6    47 ms    47 ms    47 ms  te-0-15-0-5-ar03.venice.fl.westfl.comcast.net [68.86.95.70]
  7    51 ms    47 ms    47 ms  te-0-0-0-2-ar03.bonitasprngs.fl.naples.comcast.net [68.85.238.73]
  8    40 ms    39 ms    44 ms  te-9-3-ur02.bonitasprngs.fl.naples.comcast.net [68.87.236.9]
  9    40 ms    40 ms    40 ms  nrcns.bonitasprngs.fl.naples.comcast.net [68.87.74.162]
 
Trace complete.
 
C:\>tracert 68.87.77.130
 
Tracing route to nrcns.westlandrdc.mi.michigan.comcast.net [68.87.77.130]
over a maximum of 30 hops:
 
  1    32 ms    29 ms    15 ms  174.49.8.1
  2     9 ms     8 ms     8 ms  xe-4-0-0-0-sur02.murfreesboro.tn.nash.comcast.net [68.85.50.129]
  3    11 ms    11 ms    11 ms  xe-5-1-3-0-ar01.goodslettvll.tn.nash.comcast.net [68.86.176.105]
  4    18 ms    35 ms    19 ms  pos-5-5-0-0-cr01.56marietta.ga.ibone.comcast.net [68.86.90.101]
  5    36 ms    35 ms    35 ms  he-0-15-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.89.181]
  6    41 ms    55 ms    42 ms  pos-0-13-0-0-ar01.taylor.mi.michigan.comcast.net [68.86.90.218]
  7    40 ms    40 ms    40 ms  te-9-4-ur01.westlandrdc.mi.michigan.comcast.net [68.87.190.18]
  8     *        *        *     Request timed out.
  9     *       40 ms    38 ms  nrcns.westlandrdc.mi.michigan.comcast.net [68.87.77.130]
 
Trace complete.
 



--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.


ctg1701a
VIP
join:2008-08-07
Media, PA

We found a configuration issue with a handful of validating resolvers (one of which you were pointed at) and that was corrected earlier today. Thanks for alerting us, and we have put in the necessary templates to correct this going forward.

Thanks

Chris
Comcast