Same ECS subnet sent with Anonymized ECS on and off; Google answers with Asian servers from France
Setup: macOS, DoH via Apple configuration profile, Free (France), IPv6. Served by virtua-par-1.
Problem: Google Cloud Storage (storage.googleapis.com) is very slow for me: ~2.5 s per small request instead of ~0.1 s. NextDNS returns Google's Asia-Pacific servers (2404:6800:4005::, ~250 ms ping) for a large share of queries. My router's DNS always returns European servers (~14 ms).
What I found:
- NextDNS sends Google the subnet
2a01:e20::/56. That's a Free block, but not mine; my address is in2a01:e0a::/32. - The subnet is the same with Anonymized EDNS Client Subnet off and on. I waited a while after each change and tried both. I understood that turning it off stops sending ECS entirely.
$ dig +short TXT whoami.ds.akahelp.net "ip" "193.168.204.73" "ecs" "2a01:e20::/56/56" "ns" "193.168.204.73" - When I ask Google's own name server directly,
2a01:e20::/56often gets the Asian servers. My real prefix and my IPv4 subnet get European ones:$ dig +short @ns1.google.com storage.googleapis.com AAAA +subnet=2a01:e20::/56 2404:6800:4005:825::201b ← Asia (2 of 3 tries) $ dig +short @ns1.google.com storage.googleapis.com AAAA +subnet=2a01:e0a::/56 2600:1901:4023:1b00:: ← nearby - Out of 20 queries in a row through NextDNS, between 5 and all 20 returned
2404:6800:4005::, depending on the moment.
This looks like the Viettel report: a substituted subnet that Google places far away. The difference here is that the setting doesn't seem to change what's sent.
Could you check why 2a01:e20::/56 is sent regardless of the setting? And could it be left out when the setting is off, or replaced with a subnet nearer the real one?
Diagnostic: https://nextdns.io/diag/1444e520-d21d-11f1-8397-27dc16d91e9d
The diag says "unconfigured" because it only sees the system resolver (my router). DNS actually goes through the Apple configuration profile (DoH); test.nextdns.io shows "status": "ok", server virtua-par-1, profile fpf172b21c00d36e7d. Latency to NextDNS itself is fine (~13 ms); the problem is the ECS subnet sent upstream, not the route to NextDNS.
2 replies
-
Could you please show the output of:
dig +tcp CHAOS TXT whoami.ds.akahelp.net
Content aside
-
1
Votes
- 50 min agoLast active
- 2Replies
- 28Views
-
2
Following
