Re: Cloudflare DNS contact?

[Betsy Schwartz via NANOG <nanog () lists nanog org>]

Thank you all. I will reach out. I think we've disproved my first theory
about what the issue is.

Apologies for slow response,
(trouble came in threes this week!)


On Tue, Apr 7, 2026 at 12:05 PM Steve Sullivan via NANOG <
nanog () lists nanog org> wrote:

> Hey Mark,
>
> Steve at DNS-OARC reaching out. I sent a note to the OP recommending she
> hit the OARC chat platform and mail list.
>
> Cloudflare DNS is actually pretty active in the DNS-OARC Member and
> at-large Community. Might want send these operational DNS questions to
> the dns-operations mailing list and to https://chat.dns-oarc.net.
>
> I try too when i see them, but I cannot read all the nanog mails.
>
> I hope to see you at a workshop soon.
>
> Kind regards,
>
> Steve Sullivan
> Membership Coordinator
> OARC Mattermost Chat: @stevos
> https://linktr.ee/dnsoarc
>
> On 4/6/2026 9:49 PM, marka via NANOG wrote:
> > > On 7 Apr 2026, at 12:08, Betsy Schwartz via NANOG<nanog () lists nanog org>
> wrote:
> > > We're getting reports of users trying to log in or request 2FA emails
> from
> > > Cloudflare sites (ex: California DMV) but seeing   errors that our
> well.com
> > > domain isn't recognized as valid.  Well.com  has been around since 1993
> and
> > > our primary DNS hasn't changed since perhaps 2012. . Excerpts appended
> for
> > > reference.
> > >
> > > I strongly suspect these errors are related to a Cloudflare security
> check
> > > for valid email domains. Hoping someone here can validate or disprove
> > > this.  If it's a Cloudflare issue, any contacts here?
> > >
> > > When I poke at an open cloudflare DNS server and  look up the A for
> well.com
> > > I get a disturbing error: :
> > >          server can't find well.com.well.sf.ca.us:
> > >
> > > well.sf.ca.us is an antique  (but valid) A  record in  the sf.ca.us
> zone
> > > and has no business appearing here.  Did something drop a period or
> CRLF
> > > on a list somewhere?
> > Nslookup is NOT a good diagnostic tool.  Here it presumably tried
> well.com
> > then tried well.com.well.sf.ca.us when the first query failed as you
> have
> > well.sf.ca.us in the search list.  This is one of the reasons it is not
> a
> > good diagnostic tool.  Also different versions of nslookup move onto to
> > applying the next name in the search list differently.  The only SAFE?
> way
> > to do search lists is to ONLY move to the next name on NXDOMAIN (Name
> Error).
> > Lots of search list implementations move to the next name in the search
> list
> > on SERVFAIL (you can get data from the wrong name used),  NOERROR NODATA
> (you
> > end up talking to different domains as IPv4 and IPv6 addresses
> appear/disappear).
> > I would suggest that you use a diagnostic tool like 'dig' which doesn’t
> do search
> > lists unless explicitly requested.
> >
> > Additionally if you want help, show everything you are doing.  People
> then have
> > a better chance of find errors in your testing methodology.
> >
> > > When I query AWS and Google DNS servers,  our DNS  looks correct and
> > > unchanged
> > > Thank you very much for any pointers!
> > >
> > > Betsy
> > >
> > > --
> > > Correct info:
> > > > set type=any
> > > > well.com
> > > Server:         8.8.8.8
> > > Address:        8.8.8.8#53
> > > Non-authoritative answer:
> > > Name:   well.com
> > > Address: 23.22.72.90
> > > well.com        nameserver = ns-1783.awsdns-30.co.uk.
> > > well.com        nameserver = ns-1103.awsdns-09.org.
> > > well.com        nameserver = ns-805.awsdns-36.net.
> > > well.com        nameserver = ns-459.awsdns-57.com.
> > > well.com
> > >         origin = ns-1103.awsdns-09.org
> > >         mail addr = awsdns-hostmaster.amazon.com
> > > <snip>
> > > well.com        mail exchanger = 15 xmx.well.com.
> > > <snip>
> > > --
> > > whois well.com
> > > [Querying whois.verisign-grs.com]
> > >    Domain Name: WELL.COM
> > >    Registry Domain ID: 4562093_DOMAIN_COM-VRSN
> > >    Registrar WHOIS Server: whois.enom.com
> > >    Registrar URL:http://www.enomdomains.com
> > >    Updated Date: 2020-01-24T18:46:10Z
> > >    Creation Date: 1993-01-25T05:00:00Z
> > >    Registry Expiry Date: 2029-01-26T05:00:00Z
> > >   <snip>
> > >    Name Server: NS-1103.AWSDNS-09.ORG
> > >    Name Server: NS-1783.AWSDNS-30.CO.UK
> > >    Name Server: NS-459.AWSDNS-57.COM
> > >    Name Server: NS-805.AWSDNS-36.NET
> > > <snip>
> > > _______________________________________________
> > > NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/6BU667JNHNF6XEW2G2MAVGZ5G5YCHREA/
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/DCLCRZ2QZ7ZERRSJW2TXPKQ22FISV6MJ/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/XICFG4OAF3ABPGRYRDIPE3RHISDYJMTW/