Re: Cloudflare DNS contact?

Steve Sullivan via NANOG <[email protected]> Tue, 7 Apr 2026 09:05:08 -0700
Newsgroups	gmane.org.operators.nanog
Organization	DNS-OARC
Message-ID	<[email protected]>
Hey Mark,

Steve at DNS-OARC reaching out. I sent a note to the OP recommending she 
hit the OARC chat platform and mail list.

Cloudflare DNS is actually pretty active in the DNS-OARC Member and 
at-large Community. Might want send these operational DNS questions to 
the dns-operations mailing list and to https://chat.dns-oarc.net.

I try too when i see them, but I cannot read all the nanog mails.

I hope to see you at a workshop soon.

Kind regards,

Steve Sullivan
Membership Coordinator
OARC Mattermost Chat: @stevos
https://linktr.ee/dnsoarc

On 4/6/2026 9:49 PM, marka via NANOG wrote:
>   
>
>> On 7 Apr 2026, at 12:08, Betsy Schwartz via NANOG<[email protected]> wrote:
>>
>> We're getting reports of users trying to log in or request 2FA emails from
>> Cloudflare sites (ex: California DMV) but seeing   errors that our well.com
>> domain isn't recognized as valid.  Well.com  has been around since 1993 and
>> our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for
>> reference.
>>
>> I strongly suspect these errors are related to a Cloudflare security check
>> for valid email domains. Hoping someone here can validate or disprove
>> this.  If it's a Cloudflare issue, any contacts here?
>>
>> When I poke at an open cloudflare DNS server and  look up the A for well.com
>> I get a disturbing error: :
>>          server can't find well.com.well.sf.ca.us:
>>
>> well.sf.ca.us is an antique  (but valid) A  record in  the sf.ca.us zone
>> and has no business appearing here.  Did something drop a period or  CRLF
>> on a list somewhere?
> Nslookup is NOT a good diagnostic tool.  Here it presumably tried well.com
> then tried well.com.well.sf.ca.us when the first query failed as you have
> well.sf.ca.us in the search list.  This is one of the reasons it is not a
> good diagnostic tool.  Also different versions of nslookup move onto to
> applying the next name in the search list differently.  The only SAFE? way
> to do search lists is to ONLY move to the next name on NXDOMAIN (Name Error).
> Lots of search list implementations move to the next name in the search list
> on SERVFAIL (you can get data from the wrong name used),  NOERROR NODATA (you
> end up talking to different domains as IPv4 and IPv6 addresses appear/disappear).
>
> I would suggest that you use a diagnostic tool like 'dig' which doesn’t do search
> lists unless explicitly requested.
>
> Additionally if you want help, show everything you are doing.  People then have
> a better chance of find errors in your testing methodology.
>
>> When I query AWS and Google DNS servers,  our DNS  looks correct and
>> unchanged
>> Thank you very much for any pointers!
>>
>> Betsy
>>
>> --
>> Correct info:
>>> set type=any
>>> well.com
>> Server:         8.8.8.8
>> Address:        8.8.8.8#53
>> Non-authoritative answer:
>> Name:   well.com
>> Address: 23.22.72.90
>> well.com        nameserver = ns-1783.awsdns-30.co.uk.
>> well.com        nameserver = ns-1103.awsdns-09.org.
>> well.com        nameserver = ns-805.awsdns-36.net.
>> well.com        nameserver = ns-459.awsdns-57.com.
>> well.com
>>         origin = ns-1103.awsdns-09.org
>>         mail addr = awsdns-hostmaster.amazon.com
>> <snip>
>> well.com        mail exchanger = 15 xmx.well.com.
>> <snip>
>> --
>> whois well.com
>> [Querying whois.verisign-grs.com]
>>    Domain Name: WELL.COM
>>    Registry Domain ID: 4562093_DOMAIN_COM-VRSN
>>    Registrar WHOIS Server: whois.enom.com
>>    Registrar URL:http://www.enomdomains.com
>>    Updated Date: 2020-01-24T18:46:10Z
>>    Creation Date: 1993-01-25T05:00:00Z
>>    Registry Expiry Date: 2029-01-26T05:00:00Z
>>   <snip>
>>    Name Server: NS-1103.AWSDNS-09.ORG
>>    Name Server: NS-1783.AWSDNS-30.CO.UK
>>    Name Server: NS-459.AWSDNS-57.COM
>>    Name Server: NS-805.AWSDNS-36.NET
>> <snip>
>> _______________________________________________
>> NANOG mailing list
>> https://lists.nanog.org/archives/list/[email protected]/message/6BU667JNHNF6XEW2G2MAVGZ5G5YCHREA/

_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/DCLCRZ2QZ7ZERRSJW2TXPKQ22FISV6MJ/
OpenPGP_signature.asc (application/pgp-signature, 840 B)