DNS Resolution Issue Investigation
Budget: £250 – £750 GBP
Description:
We are experiencing a critical issue with our domain (expart.com) where it is not consistently accessible across different users and networks.
Background
DNS was migrated to Cloudflare on Tuesday 7th April.
All DNS records are now managed via Cloudflare.
Proxying is enabled for the root domain and www.
HTTPS enforcement is configured.
This issue has persisted for over 72 hours since migration.
Issue Summary
Access to the website is inconsistent across different networks:
Some users can access the site normally.
Some users cannot access it on home broadband but can on mobile data.
Others experience the opposite (mobile data fails but WiFi works).
Some users receive DNS errors (e.g. NXDOMAIN).
Some users receive SSL/privacy errors.
This is affecting multiple users across different ISPs and device types.
Key Findings
Correct Resolution via Cloudflare DNS
Querying Cloudflare DNS directly (1.1.1.1) returns correct Cloudflare IPs.
The website loads successfully when using this method.
Incorrect Resolution via Certain Networks
Some networks resolve the domain to incorrect IP addresses, including:
159.100.251.128
81.99.162.48
These IPs are not associated with our hosting or Cloudflare configuration.
Multiple Incorrect IPs Identified
Different users are resolving the domain to different incorrect IPs.
This suggests inconsistent DNS responses depending on resolver, not simple caching.
Issue Not Localised
The issue affects multiple users across different networks and ISPs.
It was initially identified by a user who has not changed ISP.
It is reproducible on both WiFi and mobile data in different scenarios.
Local Testing Completed
DNS cache flushed on affected machines.
Hosts files checked (no conflicting entries).
Direct DNS override (1.1.1.1) resolves the issue.
IPv6 disabled (no impact).
Cloudflare Configuration
DNS records verified as correct in Cloudflare.
No records point to the incorrect IPs identified.
Nameservers fully updated to Cloudflare.
Proxy enabled for relevant records.
Concern
This appears to be an issue where certain external DNS resolvers are still returning incorrect or inconsistent results for the domain, despite Cloudflare being authoritative.
Given that:
Multiple incorrect IPs are being returned across different networks
The issue persists well beyond standard DNS propagation time
Cloudflare DNS returns correct results consistently
We suspect there may be:
Resolver-level caching or contamination
Legacy DNS data still being served by certain upstream resolvers
Or an issue affecting how some resolvers are querying the domain
Assistance Requested
We would appreciate your help to:
Identify which resolvers or networks are returning incorrect DNS responses for this domain
Trace where the incorrect IPs (159.100.251.128 and 81.99.162.48) may be originating from
Confirm whether there are any known issues or patterns that could cause this behaviour
Advise on any mitigation steps to ensure consistent resolution across all networks
Impact
This is currently preventing access to our website for multiple users and prospective clients, so we would appreciate any urgent assistance in identifying and resolving the root cause.
Please let me know if you require any additional data (logs, screenshots, test results, etc.).
We are experiencing a critical issue with our domain (expart.com) where it is not consistently accessible across different users and networks.
Background
DNS was migrated to Cloudflare on Tuesday 7th April.
All DNS records are now managed via Cloudflare.
Proxying is enabled for the root domain and www.
HTTPS enforcement is configured.
This issue has persisted for over 72 hours since migration.
Issue Summary
Access to the website is inconsistent across different networks:
Some users can access the site normally.
Some users cannot access it on home broadband but can on mobile data.
Others experience the opposite (mobile data fails but WiFi works).
Some users receive DNS errors (e.g. NXDOMAIN).
Some users receive SSL/privacy errors.
This is affecting multiple users across different ISPs and device types.
Key Findings
Correct Resolution via Cloudflare DNS
Querying Cloudflare DNS directly (1.1.1.1) returns correct Cloudflare IPs.
The website loads successfully when using this method.
Incorrect Resolution via Certain Networks
Some networks resolve the domain to incorrect IP addresses, including:
159.100.251.128
81.99.162.48
These IPs are not associated with our hosting or Cloudflare configuration.
Multiple Incorrect IPs Identified
Different users are resolving the domain to different incorrect IPs.
This suggests inconsistent DNS responses depending on resolver, not simple caching.
Issue Not Localised
The issue affects multiple users across different networks and ISPs.
It was initially identified by a user who has not changed ISP.
It is reproducible on both WiFi and mobile data in different scenarios.
Local Testing Completed
DNS cache flushed on affected machines.
Hosts files checked (no conflicting entries).
Direct DNS override (1.1.1.1) resolves the issue.
IPv6 disabled (no impact).
Cloudflare Configuration
DNS records verified as correct in Cloudflare.
No records point to the incorrect IPs identified.
Nameservers fully updated to Cloudflare.
Proxy enabled for relevant records.
Concern
This appears to be an issue where certain external DNS resolvers are still returning incorrect or inconsistent results for the domain, despite Cloudflare being authoritative.
Given that:
Multiple incorrect IPs are being returned across different networks
The issue persists well beyond standard DNS propagation time
Cloudflare DNS returns correct results consistently
We suspect there may be:
Resolver-level caching or contamination
Legacy DNS data still being served by certain upstream resolvers
Or an issue affecting how some resolvers are querying the domain
Assistance Requested
We would appreciate your help to:
Identify which resolvers or networks are returning incorrect DNS responses for this domain
Trace where the incorrect IPs (159.100.251.128 and 81.99.162.48) may be originating from
Confirm whether there are any known issues or patterns that could cause this behaviour
Advise on any mitigation steps to ensure consistent resolution across all networks
Impact
This is currently preventing access to our website for multiple users and prospective clients, so we would appreciate any urgent assistance in identifying and resolving the root cause.
Please let me know if you require any additional data (logs, screenshots, test results, etc.).