<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
Thanks Greg and Ondrej,
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
Many thanks for the pointer to <a href="https://kb.isc.org/docs/aa-01387">DNS Cookies in BIND 9 (isc.org)</a>
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
I have used <a href="https://ednscomp.isc.org/ednscomp/1ba42afa27">https://ednscomp.isc.org/ednscomp/1ba42afa27</a> to check if they are compliant, but the answer is ambiguous:
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
EDNS Compliance Tester
</div>
<div class="default-style">
Checking: 'sour.woinsta.com' as at 2022-05-04T13:45:39Z
</div>
<div class="default-style">
<div>
<strong><span style="color: darkred;">sour.woinsta.com.: NS lookup failed</span></strong>
</div>
<div class="default-style">
Codes
</div>
<ul>
<li><em>ok</em> - test passed.</li>
</ul>
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
Anyway, from what you have seen you are suspecting that the problem is on the woinsta.com side and not on our side ?
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
The following indeed indicates a problem related to cookies:
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
<div class="default-style">
<span style="background-color: rgb(255, 255, 255);">dig @ns1.thednscloud.com. <strong>+nocookie</strong> sour.woinsta.com A +short</span>
<br><span style="background-color: rgb(255, 255, 255);">23.82.12.29</span>
<br>
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
while
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
dig @ns1.thednscloud.com. <strong>+cookie</strong> sour.woinsta.com A +short
</div>
<div class="default-style">
; <<>> DiG 9.11.36 <<>> @ns1.thednscloud.com. +cookie sour.woinsta.com A +short
<br>; (2 servers found)
<br>;; global options: +cmd
<br>;; connection timed out; no servers could be reached
<br>
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
I will try <strong>send-cookie no </strong>for that server to confirm it is the source of the issue.
</div>
<div class="default-style">
<br>
</div>
<div class="default-style">
Cheers,
</div>
<div class="default-style">
Veronique
</div>
<div class="default-style">
<br>
</div>
</div>
<blockquote type="cite">
<div>
On 04/05/2022 14:34 Greg Choules <gregchoules+bindusers@googlemail.com> wrote:
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div dir="ltr">
Hi Veronique.
<br>
<div>
Every DNS server should support EDNS by now. It has been around for a very long time. Even if it doesn't support EDNS it should ignore it.
</div>
<div>
<br>
</div>
<div>
I made some test queries and packet captures to 23.82.12.28. Whatever this box is, please talk to the manufacturer about EDNS support.
<br>
</div>
<div>
Or.. it may be that some network infrastructure - firewalls are usually the first place to look - is blocking this traffic.
</div>
<div>
<br>
</div>
<div>
Whatever is happening at the authoritative end, it needs to be fixed. All modern recursive servers will use EDNS.
</div>
<div>
<br>
</div>
<div>
Cheers, Greg
</div>
</div>
</blockquote>
</body>
</html>