←back to thread

Tell HN: 1.1.1.1 appears to be down

135 points Wingy | 2 comments | 14 Jul 25 22:04 UTC | HN request time: 0.001s | source

Cloudflare's DNS server doesn't appear to be working.

    6:03PM storm ~ % ping 1.1.1.1
    PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
    ^C
    --- 1.1.1.1 ping statistics ---
    4 packets transmitted, 0 received, 100% packet loss, time 3103ms
Show context
gerdesj ◴[14 Jul 25 22:34 UTC] No.44566083[source]▶
DNS shouldn't be tested with ICMP. Try dig or nslookup instead. ICMP echo request/reply may help to decide reachability and nothing more.

This is a reasonable test of the DNS service on 1.1.1.1:

  $ dig @1.1.1.1 www.cloudflare.com A

  ; <<>> DiG 9.20.4-3ubuntu1.1-Ubuntu <<>> @1.1.1.1 www.cloudflare.com A
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34112
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ;; QUESTION SECTION:
  ;www.cloudflare.com.            IN      A

  ;; ANSWER SECTION:
  www.cloudflare.com.     36      IN      A       104.16.123.96
  www.cloudflare.com.     36      IN      A       104.16.124.96

  ;; Query time: 39 msec
  ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
  ;; WHEN: Mon Jul 14 23:32:57 BST 2025
  ;; MSG SIZE  rcvd: 79
[EDIT]:

  $ ping 1.1.1.1
  PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
  From 141.101.70.116 icmp_seq=1 Time to live exceeded
  64 bytes from 1.1.1.1: icmp_seq=2 ttl=50 time=126 ms
So ping fails a bit (and then works - firewall) but DNS works.

The service required is DNS not ping. Test the service.

replies(5): >>44566125 #>>44566149 #>>44566199 #>>44566279 #>>44566284 #
forbiddenlake ◴[14 Jul 25 22:41 UTC] No.44566149[source]▶
This is all true, but DNS was also down.

Signed, someone who was using 1.1.1.1 as their DNS server and hadn't configured a fallback

replies(2): >>44566211 #>>44568271 #
gerdesj ◴[14 Jul 25 22:48 UTC] No.44566211[source]▶
As a punishment: Compile and install ISC BIND from source and configure it 8)

Many home routers can resolve starting from root or if you must then: 1.1.1.1, 8.8.8.8, 8.8.4.4 will get you started. You might consider 9.9.9.9 and there are quite a few others.

I never, ever, ever, recommend using ISP provided DNS unless you know how they are configured. The anycast jobbies at least publish a policy of some sort.

replies(1): >>44566484 #
1. Tijdreiziger ◴[14 Jul 25 23:35 UTC] No.44566484[source]▶
Which home routers can resolve recursively instead of needing upstream DNS? I’ve never seen this across many brands of home routers.

Your ISP publishes T&Cs and a privacy policy too.

Furthermore, your ISP’s resolver is probably in your ISP’s network, so your queries don’t have to go out through peering/transit.

replies(1): >>44566562 #
2. gerdesj ◴[14 Jul 25 23:50 UTC] No.44566562[source]▶
"Which home routers ..."

Drayteks have a lot of options built in, including a funky DNS implementation. I've personally largely dumped them for rather more complicated jobbies but they are still very capable.