Site down, your name servers are down

Hi there,

Thank you for contacting Cloudflare Support. I’m sorry your site is unreachable. I know how stressful that is, so I’ve gone straight into the details of your zone.

First, the good news: Cloudflare’s authoritative nameservers are working normally. There is no active DNS incident on cloudflarestatus.com, and when I query the two nameservers assigned to your zone directly, both of them answer for example.com. Our DNS runs on the same anycast network as the rest of Cloudflare, with every nameserver served from all of our data centres, so a full nameserver outage is extremely unlikely. When a site is unreachable from several networks, the cause is nearly always one of the items below. I’ve listed them in the order I checked them.

1. Is the domain actually delegated to Cloudflare?

Your registrar must list exactly the two Cloudflare nameservers shown in your dashboard under DNS > Records (for example xxx.ns.cloudflare.com and yyy.ns.cloudflare.com). Any other nameservers must be removed. A typo, an old nameserver pair from a previous Cloudflare account, or a mix of Cloudflare and old-host nameservers causes intermittent failures that differ from network to network. You can check what the .com registry currently holds with:

dig +trace example.com NS
whois example.com | grep -i "name server"

2. Is DNSSEC configured correctly?

This is the most common reason for “works on some networks but not others”. If a DS record from your previous DNS provider is still published at your registrar, validating resolvers (for example 1.1.1.1, 8.8.8.8 and many ISP and mobile resolvers) return SERVFAIL, while non-validating resolvers still work. To fix it, either remove the old DS record at the registrar, or enable DNSSEC in Cloudflare (DNS > Settings) and add the new DS record that Cloudflare gives you.

dig example.com A @1.1.1.1          # SERVFAIL here...
dig example.com A @1.1.1.1 +cd      # ...but an answer with +cd (checking disabled) = DNSSEC problem

3. Do the records exist and resolve?

In DNS > Records, check that both the apex (example.com) and www have an A/AAAA or CNAME record. Also make sure the zone shows Active and not Pending or Moved. If a record is missing, you’ll get NXDOMAIN or an empty answer from our nameservers, which can look like a nameserver failure.

4. If DNS resolves, the problem is HTTP rather than DNS

If the name resolves to Cloudflare IPs but the page still won’t load, please look at the error page or run the curl command below. A Cloudflare error such as 521 (origin refused the connection), 522 (connection to the origin timed out) or 523 (origin unreachable) means our edge is up but cannot reach your web server. This is often because a firewall on the server is blocking Cloudflare’s IP ranges, or because the server is down.

curl -svo /dev/null http://example.com/
# look for: the IP connected to, the HTTP status, and the cf-ray header

So that I can confirm the exact cause, could you please reply with the following:

• the exact error message or screenshot you see, and a Ray ID if one is shown;
• the output of dig example.com and curl -svo /dev/null http://example.com/ from one affected network;
• roughly when the problem started, and whether you changed registrar, hosting or DNSSEC recently.

As soon as I have those, I’ll confirm the fix with you. In most cases this kind of issue is resolved within minutes of correcting the registrar setting, though resolvers can take up to the record’s TTL to pick up the change.

Kind regards,
Marwan
Cloudflare Customer Support