1

Same ECS subnet sent with Anonymized ECS on and off; Google answers with Asian servers from France

Setup: macOS, DoH via Apple configuration profile, Free (France), IPv6. Served by virtua-par-1.

Problem: Google Cloud Storage (storage.googleapis.com) is very slow for me: ~2.5 s per small request instead of ~0.1 s. NextDNS returns Google's Asia-Pacific servers (2404:6800:4005::, ~250 ms ping) for a large share of queries. My router's DNS always returns European servers (~14 ms).

What I found:

  1. NextDNS sends Google the subnet 2a01:e20::/56. That's a Free block, but not mine; my address is in 2a01:e0a::/32.
  2. The subnet is the same with Anonymized EDNS Client Subnet off and on. I waited a while after each change and tried both. I understood that turning it off stops sending ECS entirely.
    $ dig +short TXT whoami.ds.akahelp.net
    "ip" "193.168.204.73"
    "ecs" "2a01:e20::/56/56"
    "ns" "193.168.204.73"
  3. When I ask Google's own name server directly, 2a01:e20::/56 often gets the Asian servers. My real prefix and my IPv4 subnet get European ones:
    $ dig +short @ns1.google.com storage.googleapis.com AAAA +subnet=2a01:e20::/56
    2404:6800:4005:825::201b      ← Asia (2 of 3 tries)
    $ dig +short @ns1.google.com storage.googleapis.com AAAA +subnet=2a01:e0a::/56
    2600:1901:4023:1b00::         ← nearby
  4. Out of 20 queries in a row through NextDNS, between 5 and all 20 returned 2404:6800:4005::, depending on the moment.

This looks like the Viettel report: a substituted subnet that Google places far away. The difference here is that the setting doesn't seem to change what's sent.

Could you check why 2a01:e20::/56 is sent regardless of the setting? And could it be left out when the setting is off, or replaced with a subnet nearer the real one?

Diagnostic: https://nextdns.io/diag/1444e520-d21d-11f1-8397-27dc16d91e9d

The diag says "unconfigured" because it only sees the system resolver (my router). DNS actually goes through the Apple configuration profile (DoH); test.nextdns.io shows "status": "ok", server virtua-par-1, profile fpf172b21c00d36e7d. Latency to NextDNS itself is fine (~13 ms); the problem is the ECS subnet sent upstream, not the route to NextDNS.

2 replies

null
    • NextDNs
    • yesterday
    • Reported - view

    Could you please show the output of:

    dig +tcp CHAOS TXT whoami.ds.akahelp.net

      • Berty89
      • 50 min ago
      • Reported - view

       

      • I'm not at home right now. These results are from Free Mobile (AS51207, client 2a0d:e487:414f:…), not from my Freebox line (2a01:e0a::/32) in the original post. I'll post the same tests from home in a few days.
      • I ran dig directly against my profile's linked IPv6 endpoint, 2a07:a8c0::f8:2de3, because dig on macOS doesn't use the DoH profile. Even so, the diagnostics show profile: default. Is that expected?

      Akamai whoami:

      $ dig +tcp CHAOS TXT whoami.ds.akahelp.net @2a07:a8c0::f8:2de3
      ;; ANSWER SECTION:
      whoami.ds.akahelp.net.  20  IN  TXT  "ns" "193.168.204.73"
      
      ;; ADDITIONAL SECTION:
      proto.nextdns.io.        0  CH  TXT  "TCP"
      server.nextdns.io.       0  CH  TXT  "netbarista-par-1"
      client-name.nextdns.io.  0  CH  TXT  "unknown"
      profile.nextdns.io.      0  CH  TXT  "default"
      client.nextdns.io.       0  CH  TXT  "2a0d:e487:414f:4beb:7c7c:f6e3:578a:5d87"
      smart-ecs.nextdns.io.    0  CH  TXT  "not sent"

      Google echo name, same endpoint:

      $ dig +tcp CHAOS TXT o-o.myaddr.l.google.com @2a07:a8c0::f8:2de3
      ;; ANSWER SECTION:
      o-o.myaddr.l.google.com. 21  IN  TXT  "193.168.204.73"
      
      ;; ADDITIONAL SECTION:
      client.nextdns.io.       0  CH  TXT  "2a0d:e487:414f:4beb:7c7c:f6e3:578a:5d87"
      client-name.nextdns.io.  0  CH  TXT  "unknown"
      proto.nextdns.io.        0  CH  TXT  "TCP"
      server.nextdns.io.       0  CH  TXT  "netbarista-par-1"
      profile.nextdns.io.      0  CH  TXT  "default"
      smart-ecs.nextdns.io.    0  CH  TXT  "not sent"

Content aside

  • 1 Votes
  • 50 min agoLast active
  • 2Replies
  • 28Views
  • 2 Following