1

Same ECS subnet sent with Anonymized ECS on and off; Google answers with Asian servers from France

Setup: macOS, DoH via Apple configuration profile, Free (France), IPv6. Served by virtua-par-1.

Problem: Google Cloud Storage (storage.googleapis.com) is very slow for me: ~2.5 s per small request instead of ~0.1 s. NextDNS returns Google's Asia-Pacific servers (2404:6800:4005::, ~250 ms ping) for a large share of queries. My router's DNS always returns European servers (~14 ms).

What I found:

  1. NextDNS sends Google the subnet 2a01:e20::/56. That's a Free block, but not mine; my address is in 2a01:e0a::/32.
  2. The subnet is the same with Anonymized EDNS Client Subnet off and on. I waited a while after each change and tried both. I understood that turning it off stops sending ECS entirely. 
    $ dig +short TXT whoami.ds.akahelp.net
"ip" "193.168.204.73"
"ecs" "2a01:e20::/56/56"
"ns" "193.168.204.73"
  3. When I ask Google's own name server directly, 2a01:e20::/56 often gets the Asian servers. My real prefix and my IPv4 subnet get European ones: 
    $ dig +short @ns1.google.com storage.googleapis.com AAAA +subnet=2a01:e20::/56
2404:6800:4005:825::201b      ← Asia (2 of 3 tries)
$ dig +short @ns1.google.com storage.googleapis.com AAAA +subnet=2a01:e0a::/56
2600:1901:4023:1b00::         ← nearby
  4. Out of 20 queries in a row through NextDNS, between 5 and all 20 returned 2404:6800:4005::, depending on the moment.

This looks like the Viettel report: a substituted subnet that Google places far away. The difference here is that the setting doesn't seem to change what's sent.

Could you check why 2a01:e20::/56 is sent regardless of the setting? And could it be left out when the setting is off, or replaced with a subnet nearer the real one?

Diagnostic: https://nextdns.io/diag/1444e520-d21d-11f1-8397-27dc16d91e9d

The diag says "unconfigured" because it only sees the system resolver (my router). DNS actually goes through the Apple configuration profile (DoH); test.nextdns.io shows "status": "ok", server virtua-par-1, profile fpf172b21c00d36e7d. Latency to NextDNS itself is fine (~13 ms); the problem is the ECS subnet sent upstream, not the route to NextDNS.

4 replies

null
    • NextDNs
    • 3 days ago
    • Reported - view

    Could you please show the output of:

    dig +tcp CHAOS TXT whoami.ds.akahelp.net

      • Berty89
      • 2 days ago
      • Reported - view

       

      • I'm not at home right now. These results are from Free Mobile (AS51207, client 2a0d:e487:414f:…), not from my Freebox line (2a01:e0a::/32) in the original post. I'll post the same tests from home in a few days.
      • I ran dig directly against my profile's linked IPv6 endpoint, 2a07:a8c0::f8:2de3, because dig on macOS doesn't use the DoH profile. Even so, the diagnostics show profile: default. Is that expected?

      Akamai whoami:

      $ dig +tcp CHAOS TXT whoami.ds.akahelp.net @2a07:a8c0::f8:2de3
;; ANSWER SECTION:
whoami.ds.akahelp.net.  20  IN  TXT  "ns" "193.168.204.73"

;; ADDITIONAL SECTION:
proto.nextdns.io.        0  CH  TXT  "TCP"
server.nextdns.io.       0  CH  TXT  "netbarista-par-1"
client-name.nextdns.io.  0  CH  TXT  "unknown"
profile.nextdns.io.      0  CH  TXT  "default"
client.nextdns.io.       0  CH  TXT  "2a0d:e487:414f:4beb:7c7c:f6e3:578a:5d87"
smart-ecs.nextdns.io.    0  CH  TXT  "not sent"

      Google echo name, same endpoint:

      $ dig +tcp CHAOS TXT o-o.myaddr.l.google.com @2a07:a8c0::f8:2de3
;; ANSWER SECTION:
o-o.myaddr.l.google.com. 21  IN  TXT  "193.168.204.73"

;; ADDITIONAL SECTION:
client.nextdns.io.       0  CH  TXT  "2a0d:e487:414f:4beb:7c7c:f6e3:578a:5d87"
client-name.nextdns.io.  0  CH  TXT  "unknown"
proto.nextdns.io.        0  CH  TXT  "TCP"
server.nextdns.io.       0  CH  TXT  "netbarista-par-1"
profile.nextdns.io.      0  CH  TXT  "default"
smart-ecs.nextdns.io.    0  CH  TXT  "not sent"
      • NextDNs
      • yesterday
      • Reported - view

       Could you run the same command a few times, a few seconds apart, and check whether profile.nextdns.io changes from default to fpf172b21c00d36e7d?

      If it stays on default, please share the output and approximate test time.

      • Berty89
      • yesterday
      • Reported - view

       

      I ran the command 20 times, 5 seconds apart, in two batches at 08:49–08:50 and 08:51–08:52 UTC on 30 Oct. profile.nextdns.io returned fpf172b21c00d36e7d on all 20 runs, so I couldn't reproduce default.

      smart-ecs.nextdns.io also changed from not sent to 2a0d:e480::/56, and ecs shows the same subnet. These tests are again from Free Mobile (AS51207), so they don't cover the original 2a01:e20::/56 problem on my Freebox line. I'm away for the next few days and will repeat the test from home when I'm back.

      Google Cloud Storage is fast on this connection today: first byte in about 0.2 s, compared with about 2.5 s before, and no Asia-Pacific answers in these checks. However, querying the NextDNS endpoint directly returned 2607:f8b0:4002:…, and ns1.google.com returns the same range for 2a0d:e480::/56. That looks like North America rather than Europe, so this subnet may still not be a good match for a client in France.

      One run:

      whoami.ds.akahelp.net.  300 IN TXT "ecs" "2a0d:e480::/56/56"
whoami.ds.akahelp.net.  300 IN TXT "ip" "193.168.204.73"
whoami.ds.akahelp.net.  300 IN TXT "ns" "193.168.204.73"
server.nextdns.io.      0   CH TXT "netbarista-par-1"
proto.nextdns.io.       0   CH TXT "TCP"
profile.nextdns.io.     0   CH TXT "fpf172b21c00d36e7d"
client-name.nextdns.io. 0   CH TXT "unknown"
smart-ecs.nextdns.io.   0   CH TXT "2a0d:e480::/56"
Login to reply

Content aside

  • 1 Votes
  • 22 hrs agoLast active
  • 4Replies
  • 55Views
  • 2 Following