According to https://downdetector.com/status/xfinity/ and r/comcast, looks like Comcast/Xfinity is having a DNS outage. Anyone have any insight into what's going on over there?
Nice! Another alternative is to use a different protocol, i.e., instead of using DNS over 53/udp, use dnscrypt (ports 443 TCP/UDP) via something like dnscrypt-proxy. This has an additional benefit of not leaking your DNS queries to your ISP.
I'm actually enforcing encrypted DNS and blocking destination port 53 outbound on my firewall at home, that's why I couldn't re-run the script I was using to test the current availability and response times on all these.
(It wouldn't be a lot of work to run the tests from one of my cloud servers or disable the firewall rule temporarily, but I figured someone on HN might tell me which ones stopped working and spare me the effort.)
dnscrypt is a separate protocol so you'd need a different list of servers. But those are readily available and tagged with their filter (e.g. no malware or no adult domains) and privacy (e.g. no log, no edns-client-subnet, qname minimization) policies.
I’m not a Comcast subscriber, but we first noticed this when a weirdly coordinated wave of our customers — first in Florida, then moving north up all the way through New England — started screaming into our support phones that our site was down and they were losing business as a result.
After last week’s AWS US-East-1 outage, this has not been a good couple of days to be dependent on someone else’s infrastructure, even something as fundamental as a customer’s ISP…
Was not just DNS. We are in South Florida and run internal DNS with next hops to 1.1.1.1 and 8.8.8.8. We had about 30% of sites not available even with DNS resolving. As of 1:00 EST all is working now.....
I was having an issue connecting to Netflix earlier, until I used VPN. I momentarily wondered if Comcast was going back to their old practices of sabotaging streaming services from 10 years ago. DownDetector said Netflix was down, other sites worked, it makes sense that Comcast is up to no good, right?
But I don't use Comcast DNS. Netflix would be the only site I visited which has a peering agreement with Comcast. It makes more sense that the route between Comcast and Netflix is broken, regardless of my local DNS lookups being unaffected, than malfeasance on Comcast's part. The route from Comcast to VPN to Netflix, on the other hand, is unaffected.
Not for many years but they have started trying to sell us a spyware 'security edge' appliance that we've noped out of that seems to break DNS for some people.
Comcast is the only real option around here, and for years almost every time I had connection problems it ended up being their DNS. I've switched to 1.1.1.1 and haven't looked back.
Only resolves names that are allowed. Basically, a reject-list is too hard to maintain - a growing list everyday! But a permit-list is small(er) and finite; easy to expand for a fews hours/days when needed.
It keeps my home network much quieter; blocks nearly all bullshit (ads, malware, etc) and is easier to maintain.
So you only allow devices on your network to resolve domains on your predefined list? I'm surprised that that's easier to maintain than a reject-list, although I'll grant that it's safer.
Some routing issue, too: Neither 8.8.8.8 nor 1.1.1.1 solved things, though they both did... resolve things. So to speak. But turning on a VPN fixed everything immediately.
Google or Cloudflare. Both have fewer outages (IME) than Comcast. It just depends on who you want to share your web history with. I've seen Comcast lose DNS in the past even though the underlying transport still worked. It's bad for someone not technically able to change their DNS settings.
I don't get the numeric reference? (oh, wait, I do now, thanks to the sibling post; didn't expect that in this context), but a french telecom owns those IPs (they're part of the same /12 allocation), I'm sure there's some way to convince them to let you borrow or buy the two /24s you'd need out of there.
I used it for benchmarking and checking propagation/filtering but I haven't tested them for a while, can't say they're all still working.