Authoritative DNS returns NXDOMAIN for routerpool7.rlb.teamviewer.com

anyuserqwerty

Teamviewer is unable to connect to the servers because it is getting NXDOMAIN replies when trying to connect to router7.teamviewer.com (or any other routerX hostname).

The auhtoritative response to router7.teamviewer.com is ok and it is a CNAME routerpool7.rlb.teamviewer.com. But response to A query for routerpool7.rlb.teamviewer.com on authoritave DNS server 185.81.208.1 is NXDOMAIN

@185.81.208.1 routerpool7.rlb.teamviewer.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @185.81.208.1 routerpool7.rlb.teamviewer.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45639
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;routerpool7.rlb.teamviewer.com.        IN      A

;; Query time: 186 msec
;; SERVER: 185.81.208.1#53(185.81.208.1)
;; WHEN: Tue Apr 28 08:21:23 CEST 2020
;; MSG SIZE  rcvd: 5

This happens only in specific network. Could that be an issue on your DNS server or datacenter? 

Besides that it seems that there is also an issue with DNSSEC according to dnsviz https://dnsviz.net/d/router7.teamviewer.com/Xqc93A/dnssec/

JeanK

We have made changes to the DNS setup, which should fix this problem.

Please test again to see if the problem persists or is resolved.

@Quppa @rhymeswithmogul @768kb @jeansieb @anyuserqwerty

We are looking forward to hearing your feedback!

/JeanK

JeanK

Hello @anyuserqwerty 

Thank you for your message and welcome in the Community! ?

We have forwarded your input to our dedicated team.
We are investigating this right now.

Best,

Jean

jeansieb

Good day

What is the update of this issue?
I see that we are also randomly getting NXDOMAIN for any of the routerpoolX.rlb.teamviewer.com domains from all of your authorative servers. 
DNSSEC is still broken (Incomplete) which seems to be the cause for this.
https://dnsviz.net/d/router7.teamviewer.com/Xqc93A/dnssec/
https://dnsviz.net/d/router5.teamviewer.com/dnssec/

jeansieb

Good day

Of further investigation I am finding that randomly, any of the routerpoolX.rlb.teamviewer.com hostnames can not get and answer from ANY of the TeamViewer name servers

tv-ns1.rlb.teamviewer.com
tv-ns2.rlb.teamviewer.com
tv-ns3.rlb.teamviewer.com
tv-ns4.rlb.teamviewer.com
tv-ns5.rlb.teamviewer.com

Direct lookup against them, a dig +trace from a host, or a recursive lookup via my server, all have this behaviour and show that the authorative servers are randomly giving a NXDOMAIN answer.

DNSSEC is still broken for your DNS, and has been reported months ago. 

When can we expect a resolution to this?

768kb

This is still the same:

Dec 20 19:35:39 fedoralaptop systemd-resolved[733]: [🡕] DNSSEC validation failed for question routerpool11.rlb.teamviewer.com IN SOA: failed-auxiliary

Dec 20 19:35:40 fedoralaptop systemd-resolved[733]: [🡕] DNSSEC validation failed for question routerpool5.rlb.teamviewer.com IN SOA: failed-auxiliary

Dec 20 19:35:40 fedoralaptop systemd-resolved[733]: [🡕] DNSSEC validation failed for question routerpool12.rlb.teamviewer.com IN A: failed-auxiliary

Dec 20 19:35:40 fedoralaptop systemd-resolved[733]: [🡕] DNSSEC validation failed for question routerpool6.rlb.teamviewer.com IN A: failed-auxiliary

Guys, please disable DNSSEC, or take some time to configure it right.

rhymeswithmogul

This is still a problem. I have to manually disable DNSSEC validation on any of my personal or customer networks where TeamViewer is in use. I'm sick of compromising my security just to use this app.

DNSSEC isn't hard. Log me onto your DNS servers and I'll fix this in minutes. It shouldn't take TeamViewer years to even respond.

Quppa

@JeanK can this be raised again internally?

This issue means that TeamViewer is broken (stuck in the 'Not ready. Please check your connection' state) on a fresh Fedora install when using DNS servers that support DNSSEC (including Cloudflare's 1.1.1.1 and Google's 8.8.8.8).

https://www.quppa.net/blog/2022/11/07/teamviewer-dnssec-broken/

JeanK

We have made changes to the DNS setup, which should fix this problem.

Please test again to see if the problem persists or is resolved.

@Quppa @rhymeswithmogul @768kb @jeansieb @anyuserqwerty

We are looking forward to hearing your feedback!

/JeanK

Quppa

Thanks @JeanK - I can confirm my systemd-resolved issue is gone and the DNS analysis looks healthier (before, after).

JeanK

Thank you, @Quppa, for taking the time to update us!

Have a great day, and see you soon!

/JeanK