Cloudflare pages.dev domain unreachable
There seems to be some kind of DNS issue with the Cloudflare pages.dev domain.
No Cloudflare Pages projects are loading under their pages.dev domain across all accounts.
We can see Cloudflare Pages is currently experiencing degraded performance, but it seems unrelated to this.
https://www.cloudflarestatus.com/incidents/psbtf5g99qjc
We've created a topic in the Community Community below.
https://community.cloudflare.com/t/cloudflare-pages-dev-domain-unreachable/822951
This is affecting some of our projects that are being actively worked on leading up to launch, but haven't yet been launched on custom domains yet.
If anyone else is experiencing this, can you please let us know and report it to Cloudflare as well so we can get this resolved?
Thanks!
23 Replies
You'd have to share a few pages.devs as examples to do anything with the report. Mine seem fine at least..
Always been a few mins delay on new project creation to them resolving in dns if you're talking about purely brand new projects
Hi, Chaika. Thanks for taking a look. Here's an example site.
https://journi-landing.pages.dev/
I can replicate this on the apex pages.dev domain itself.
Good shout about new projects, but I'm referring to existing projects.
We're experiencing this across Cloudflare accounts on different devices and networks.
Journi
Journi is a free interactive road safety education program for Years 5&6.
That doesn't resolve for you? Are you in a restricted environment (like a country known to do filtering like Turkey, China, Russia, or a corporate environment)?
That website resolves for me and discord, and on tools, etc https://dnschecker.org/#A/journi-landing.pages.dev
Yeah, that's strange, I'm also having trouble replicating this on tools like DNS checkers.
We're in Brisbane, Australia.
We found out about this from clients logging issues and weren't able to replicate originally until clearing the DNS cache on our devices.
If it's happening on your device as well that'd make troubleshooting much easier. I'd run
nslookup journi-landing.pages.dev if on win or dig journi-landing.pages.dev on linux/mac and see the response.
It could be ISP's filtering, some of them will try to filter out bad sites for their customersYeah, it looks like it could be ISP related given how it's manifesting.
Thanks, Chaika, I'll do some more digging and report back here.
Do you know what the process for getting a Cloudflare domain unblocked by an Australian ISP would look like?
I have no idea about Australia specifically but generally you would just contact the ISP and tell them about the false positive, and ask them to remove it. Some ISPs may have public pages to look up block info and request it being removed.
In the short term, you could ask Customers to switch DNS to Cloudflare's 1.1.1.1, Google 8.8.8.8, or Quad9 9.9.9.9, etc.
In theory, any good blocking tool/setup would respect the Public Suffix List (PSL) which pages.dev is on, which tells them to treat each subdomain (x.pages.dev vs y.pages.dev) as its own website and avoid blanket blocking them, but in reality some just don't care.
This is of course assuming they are blocking it. To find out, you'd want to test querying it on the network in question, and see the dns response. It would also be smart to check switching to 1.1.1.1 or any one of the alt providers and see if they are hijacking responses
if it is dns filtering, another option for you is to add Custom Domains to everything. You can custom domain specific branches too: https://developers.cloudflare.com/pages/how-to/custom-branch-aliases/
Thank you!
Do you have any ideas of which ISPs it may be? I was looking via Ripe Atlas which is a tool which runs measurements/queries on remote probes people host, there's a bunch on residental networks.
Most respond correctly for Australia though: https://atlas.ripe.net/measurements/120991134
RIPE Atlas - RIPE Network Coordination Centre
RIPE Atlas is the RIPE NCC's main Internet data measurement system.
Hmmm, that's not loading for me, but in our case it should be TPG.
Oh, that just loaded.
Not sure I understand those results though.
Just showing the results of the dns query from various probes
if I filter it to just TPG on asn 7545, https://atlas.ripe.net/measurements/120991618, there is a number of responses
RIPE Atlas - RIPE Network Coordination Centre
RIPE Atlas is the RIPE NCC's main Internet data measurement system.
including a probe in Brisbane using TPG who got a successful answer, curious
maybe they offer different filtering levels/options? eh
If nothing else, it shows this doesn't seem very widespread and is somewhat focused/isolated to something.
Sorry, Chaika, just had to go offline for a while.
Thanks for explaining that, interesting tool.
This is what nslookup returns.
nslookup pages.dev
Server: 2001:8004:1180:39e3::85
Address: 2001:8004:1180:39e3::85#53
** server can't find pages.dev: NXDOMAIN
I can confirm enabling 1.1.1.1 on the impacted devices works, but this stops working as soon as 1.1.1.1 is disabled again.
nslookup pages.dev
Server: 203.12.160.35
Address: 203.12.160.35#53
Non-authoritative answer:
Name: pages.dev
Address: 104.18.21.135
Name: pages.dev
Address: 104.18.20.135
A similar Ripe Atlas measurement of pages.dev doesn't look so great.
3 probes reached their target.
138 probes did not.
https://atlas.ripe.net/measurements/121003667/
RIPE Atlas - RIPE Network Coordination Centre
RIPE Atlas is the RIPE NCC's main Internet data measurement system.
Interestingly, it says "ONE-OFF DNS measurement to 2001:8004:1180:39e3::85 via IPv6", which matches the IPv6 address that nslookup returns an error for.
2001:8004:1180:39e3::85 means it was forcing that dns server, 2001:8004:1180:39e3::85 isn't a publicily accessible dns server so it's not going to work on most networks
203.12.160.35 comes up as TPG's IP space and 2001:8004:1180:39e3::85 comes up as Telstra's, curious, but yea if it's nxdomaining just on their stuff does seem to be an ip dns server misconfiguration or blocking
Right, that actually makes sense, my bad, we've been testing across different networks and devices, so I got confused about the ISPs.
I can confirm that nslookup above which returned an error was from the Telstra network and that nslookup from the TPG network does work as expected.
Do you know if Cloudflare has a stance on ISPs blocking critical services?
Like, we can look into the process and reach out to Telstra ourselves, but at this point there's no guarantee how long that will take or the outcome.
Shouldn't Cloudflare care if their services are disrupted and don't they have a formal process for resolving this kind of issue with ISPs?
There's no formal process afaik, at least no report form or anything like that. If there's enough reports Cloudflare sometimes throws up Status Pages https://www.cloudflarestatus.com/incidents/ty5lgvkd41lm and tries to connect the ISP via their NOC and such, but fundamentally ISPs are not beholden to Cloudflare, but instead their customers
Looks like that is the cause though, Telstra's default dns is nxdomaining: https://atlas.ripe.net/measurements/121132131. Some there aren't using Telsra's DNS (can tell in nsid) but the ones which are nxdomain. They do seem to have a requested block website removal, hmm https://www.telstra.com.au/forms/report-misuse-of-service. curious their way of blocking is just nxdomain though
Interesting, thanks.
Wouldn't something like RIPE Atlas measurements showing multiple probes not working be regarded as enough reports by Cloudflare?
It's a strange scenario, because Telstra is the largest ISP in Australia, which is why we're seeing a lot of devices impacted, for us and clients.
I'm not sure how many users in Australia are using Cloudflare Pages specifically, but waiting for more users to experience and report this could take a while depending on that and doesn't seem like a great strategy for current and future users.
Any suggestions on best next steps to resolve this Cloudflare Pages and Telstra issue?
I'll ask
In the short term, what you can do is:
Use Custom Domains instead of pages.dev, Clients should visit using the custom domain
Devs/anyone accessing previews can switch to a different DNS
Report False Positive/dns resolution issues to Telstra thru whatever avenues you have
Thanks mate, appreciate it.