Direct IPv6 addresses of c.desec.io not working

1

I was trying to query the DNS instances in the anycast directly, to see how fast the replication is, see:

I found the instances at desec-automation/hosts/all.yml at main · desec-io/desec-automation · GitHub.
Which all can be queried over IPv4, but only .a.desec.io works for me over IPv6:

echo @{ams,dfw,sao,fra,hkg,jnb,syd}-1.a.desec.io \
| xargs -P7 -n1 dig +tries=1 -6 +short TXT test.onverwijld.nl

"alice"
"alice"
"alice"
"alice"
"alice"
"alice"
"alice"

echo @{dxb,fra,lax,sin,lga,lhr,scl,tyo}-1.c.desec.io \
| xargs -P8 -n1 dig +tries=1 -6 +short TXT test.onverwijld.nl

;; communications error to 2403:2500:400:20::635#53: timed out
;; no servers could be reached
;; communications error to 2a00:dd80:20::d91#53: timed out
;; no servers could be reached
;; communications error to 2607:f740:c::6f9#53: timed out
;; no servers could be reached
;; communications error to 2607:f740:f::8e9#53: timed out
;; no servers could be reached
;; communications error to 2607:f740:56:10::3e9#53: timed out
;; no servers could be reached
;; communications error to 2a00:dd80:3f:100::502#53: timed out
;; no servers could be reached
;; communications error to 2403:2500:300::480#53: timed out
;; communications error to 2a00:dd80:3a::21e#53: timed out
;; no servers could be reached
;; no servers could be reached

While querying the IPv6 anycast ns2.desec.org has no issues.
Is this a deliberate difference or due to a software configuration difference?

2

Hi bwb,

This is an internal implementation detail and we do not publicly describe unicast service for any of our nodes.

Note that there’s also no assurance that the anycast network(s) are composed of the particular hosts you found. At any given time, it may be the same, more, less, or an entirely different set of hosts, and it may change at any time without notice.

Stay secure,
Peter

1 Like
3

Hi Peter,

Of course I was trying to accomplish API: Query for DNS record propagation · Issue #577 · desec-io/desec-stack · GitHub because of Ns1.desec.io replication issues.
I fully understand the automation host file is always lagging behind, and lacks active changes in BGP announcements. A simple unicast list – with all reservations of not being the same as the active anycast nodes – would be great for low level debugging. But I have no idea about security considerations regarding such a public list.

Thanks for all the work,
Benjamin