Cloudflare DNS contact?
We're getting reports of users trying to log in or request 2FA emails from Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference. I strongly suspect these errors are related to a Cloudflare security check for valid email domains. Hoping someone here can validate or disprove this. If it's a Cloudflare issue, any contacts here? When I poke at an open cloudflare DNS server and look up the A for well.com I get a disturbing error: : server can't find well.com.well.sf.ca.us: well.sf.ca.us is an antique (but valid) A record in the sf.ca.us zone and has no business appearing here. Did something drop a period or CRLF on a list somewhere? When I query AWS and Google DNS servers, our DNS looks correct and unchanged Thank you very much for any pointers! Betsy -- Correct info:
set type=any well.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: well.com Address: 23.22.72.90 well.com nameserver = ns-1783.awsdns-30.co.uk. well.com nameserver = ns-1103.awsdns-09.org. well.com nameserver = ns-805.awsdns-36.net. well.com nameserver = ns-459.awsdns-57.com. well.com origin = ns-1103.awsdns-09.org mail addr = awsdns-hostmaster.amazon.com <snip> well.com mail exchanger = 15 xmx.well.com. <snip> -- whois well.com [Querying whois.verisign-grs.com] Domain Name: WELL.COM Registry Domain ID: 4562093_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.enom.com Registrar URL: http://www.enomdomains.com Updated Date: 2020-01-24T18:46:10Z Creation Date: 1993-01-25T05:00:00Z Registry Expiry Date: 2029-01-26T05:00:00Z <snip> Name Server: NS-1103.AWSDNS-09.ORG Name Server: NS-1783.AWSDNS-30.CO.UK Name Server: NS-459.AWSDNS-57.COM Name Server: NS-805.AWSDNS-36.NET <snip>
I'm failing to reproduce the errors you see. Checking the authoritative nameservers for `well.com` yields `23.22.72.90` for the A record and nothing for the AAAA record: % dig +trace NS well.com ... well.com. 172800 IN NS ns-1103.awsdns-09.org. well.com. 172800 IN NS ns-1783.awsdns-30.co.uk. well.com. 172800 IN NS ns-459.awsdns-57.com. well.com. 172800 IN NS ns-805.awsdns-36.net. % for i in ns-1103.awsdns-09.org ns-1783.awsdns-30.co.uk ns-459.awsdns-57.com ns-805.awsdns-36.net; do dig @$i +short A well.com; done 23.22.72.90 23.22.72.90 23.22.72.90 23.22.72.90 When querying Cloudflare's resolver, I get the same answer as what the authoritative servers return from where I am: % dig @1.1.1.1 +short A well.com 23.22.72.90 And I can see that some third-party websites all show correct functionality, including what Cloudflare returns: * https://dnsviz.net/d/well.com/dnssec/ * https://www.digwebinterface.com/?hostnames=well.com&type=A&useresolver=9.9.9.10&ns=all&nameservers= We can continue off-list if you like. -- Alexander Huynh Cloudflare, Inc.
Once upon a time, Betsy Schwartz via NANOG <nanog@lists.nanog.org> said:
We're getting reports of users trying to log in or request 2FA emails from Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference.
You didn't include any excerpt showing the problem, you only included a check against 8.8.8.8 and whois. Also, running an ANY query against a caching resolver is not a good test, it has unpredictable results. -- Chris Adams <cma@cmadams.net>
On 4/6/2026 10:37 PM, Chris Adams via NANOG wrote:
Once upon a time, Betsy Schwartz via NANOG<nanog@lists.nanog.org> said:
We're getting reports of users trying to log in or request 2FA emails from Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference. You didn't include any excerpt showing the problem, you only included a check against 8.8.8.8 and whois. Also, running an ANY query against a caching resolver is not a good test, it has unpredictable results.
Also to that point, specifically in the case of Cloudflare, their resolvers do not support ANY queries since 2015. https://developers.cloudflare.com/1.1.1.1/faq/?utm_source=chatgpt.com#does-1... -Vinny
On 7 Apr 2026, at 12:08, Betsy Schwartz via NANOG <nanog@lists.nanog.org> wrote:
We're getting reports of users trying to log in or request 2FA emails from Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference.
I strongly suspect these errors are related to a Cloudflare security check for valid email domains. Hoping someone here can validate or disprove this. If it's a Cloudflare issue, any contacts here?
When I poke at an open cloudflare DNS server and look up the A for well.com I get a disturbing error: : server can't find well.com.well.sf.ca.us:
well.sf.ca.us is an antique (but valid) A record in the sf.ca.us zone and has no business appearing here. Did something drop a period or CRLF on a list somewhere?
Nslookup is NOT a good diagnostic tool. Here it presumably tried well.com then tried well.com.well.sf.ca.us when the first query failed as you have well.sf.ca.us in the search list. This is one of the reasons it is not a good diagnostic tool. Also different versions of nslookup move onto to applying the next name in the search list differently. The only SAFE? way to do search lists is to ONLY move to the next name on NXDOMAIN (Name Error). Lots of search list implementations move to the next name in the search list on SERVFAIL (you can get data from the wrong name used), NOERROR NODATA (you end up talking to different domains as IPv4 and IPv6 addresses appear/disappear). I would suggest that you use a diagnostic tool like 'dig' which doesn’t do search lists unless explicitly requested. Additionally if you want help, show everything you are doing. People then have a better chance of find errors in your testing methodology.
When I query AWS and Google DNS servers, our DNS looks correct and unchanged Thank you very much for any pointers!
Betsy
-- Correct info:
set type=any well.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: well.com Address: 23.22.72.90 well.com nameserver = ns-1783.awsdns-30.co.uk. well.com nameserver = ns-1103.awsdns-09.org. well.com nameserver = ns-805.awsdns-36.net. well.com nameserver = ns-459.awsdns-57.com. well.com origin = ns-1103.awsdns-09.org mail addr = awsdns-hostmaster.amazon.com <snip> well.com mail exchanger = 15 xmx.well.com. <snip> -- whois well.com [Querying whois.verisign-grs.com] Domain Name: WELL.COM Registry Domain ID: 4562093_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.enom.com Registrar URL: http://www.enomdomains.com Updated Date: 2020-01-24T18:46:10Z Creation Date: 1993-01-25T05:00:00Z Registry Expiry Date: 2029-01-26T05:00:00Z <snip> Name Server: NS-1103.AWSDNS-09.ORG Name Server: NS-1783.AWSDNS-30.CO.UK Name Server: NS-459.AWSDNS-57.COM Name Server: NS-805.AWSDNS-36.NET <snip>
NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/6BU667JN...
-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
Hi Betsy, Cloudflare DNS hangs out in the dns- oarc community. You can reach out here: <https://chat.dns-oarc.net>. You can self\- subscribe to our Community chat there. All DNS All Day long. Also, we operate the dns-operations@dns-oarc.net, and several other lists and initiatives that are operational DNS focused. Feel free to reach out with questions. I will be at NANOG in Bellevue in a few months too if you are attending. Kind regards, Steve Sullivan Membership Coordinator OARC Mattermost Chat: @stevos https://linktr.ee/dnsoarc On 4/6/2026 7:08 PM, Betsy Schwartz via NANOG wrote:
We're getting reports of users trying to log in or request 2FA emails from Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference.
I strongly suspect these errors are related to a Cloudflare security check for valid email domains. Hoping someone here can validate or disprove this. If it's a Cloudflare issue, any contacts here?
When I poke at an open cloudflare DNS server and look up the A for well.com I get a disturbing error: : server can't find well.com.well.sf.ca.us:
well.sf.ca.us is an antique (but valid) A record in the sf.ca.us zone and has no business appearing here. Did something drop a period or CRLF on a list somewhere?
When I query AWS and Google DNS servers, our DNS looks correct and unchanged Thank you very much for any pointers!
Betsy
-- Correct info:
set type=any well.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: well.com Address: 23.22.72.90 well.com nameserver = ns-1783.awsdns-30.co.uk. well.com nameserver = ns-1103.awsdns-09.org. well.com nameserver = ns-805.awsdns-36.net. well.com nameserver = ns-459.awsdns-57.com. well.com origin = ns-1103.awsdns-09.org mail addr = awsdns-hostmaster.amazon.com <snip> well.com mail exchanger = 15 xmx.well.com. <snip> -- whois well.com [Querying whois.verisign-grs.com] Domain Name: WELL.COM Registry Domain ID: 4562093_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.enom.com Registrar URL:http://www.enomdomains.com Updated Date: 2020-01-24T18:46:10Z Creation Date: 1993-01-25T05:00:00Z Registry Expiry Date: 2029-01-26T05:00:00Z <snip> Name Server: NS-1103.AWSDNS-09.ORG Name Server: NS-1783.AWSDNS-30.CO.UK Name Server: NS-459.AWSDNS-57.COM Name Server: NS-805.AWSDNS-36.NET <snip>
NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/6BU667JN...
Hey Mark, Steve at DNS-OARC reaching out. I sent a note to the OP recommending she hit the OARC chat platform and mail list. Cloudflare DNS is actually pretty active in the DNS-OARC Member and at-large Community. Might want send these operational DNS questions to the dns-operations mailing list and to https://chat.dns-oarc.net. I try too when i see them, but I cannot read all the nanog mails. I hope to see you at a workshop soon. Kind regards, Steve Sullivan Membership Coordinator OARC Mattermost Chat: @stevos https://linktr.ee/dnsoarc On 4/6/2026 9:49 PM, marka via NANOG wrote:
On 7 Apr 2026, at 12:08, Betsy Schwartz via NANOG<nanog@lists.nanog.org> wrote:
We're getting reports of users trying to log in or request 2FA emails from Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference.
I strongly suspect these errors are related to a Cloudflare security check for valid email domains. Hoping someone here can validate or disprove this. If it's a Cloudflare issue, any contacts here?
When I poke at an open cloudflare DNS server and look up the A for well.com I get a disturbing error: : server can't find well.com.well.sf.ca.us:
well.sf.ca.us is an antique (but valid) A record in the sf.ca.us zone and has no business appearing here. Did something drop a period or CRLF on a list somewhere? Nslookup is NOT a good diagnostic tool. Here it presumably tried well.com then tried well.com.well.sf.ca.us when the first query failed as you have well.sf.ca.us in the search list. This is one of the reasons it is not a good diagnostic tool. Also different versions of nslookup move onto to applying the next name in the search list differently. The only SAFE? way to do search lists is to ONLY move to the next name on NXDOMAIN (Name Error). Lots of search list implementations move to the next name in the search list on SERVFAIL (you can get data from the wrong name used), NOERROR NODATA (you end up talking to different domains as IPv4 and IPv6 addresses appear/disappear).
I would suggest that you use a diagnostic tool like 'dig' which doesn’t do search lists unless explicitly requested.
Additionally if you want help, show everything you are doing. People then have a better chance of find errors in your testing methodology.
When I query AWS and Google DNS servers, our DNS looks correct and unchanged Thank you very much for any pointers!
Betsy
-- Correct info:
set type=any well.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: well.com Address: 23.22.72.90 well.com nameserver = ns-1783.awsdns-30.co.uk. well.com nameserver = ns-1103.awsdns-09.org. well.com nameserver = ns-805.awsdns-36.net. well.com nameserver = ns-459.awsdns-57.com. well.com origin = ns-1103.awsdns-09.org mail addr = awsdns-hostmaster.amazon.com <snip> well.com mail exchanger = 15 xmx.well.com. <snip> -- whois well.com [Querying whois.verisign-grs.com] Domain Name: WELL.COM Registry Domain ID: 4562093_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.enom.com Registrar URL:http://www.enomdomains.com Updated Date: 2020-01-24T18:46:10Z Creation Date: 1993-01-25T05:00:00Z Registry Expiry Date: 2029-01-26T05:00:00Z <snip> Name Server: NS-1103.AWSDNS-09.ORG Name Server: NS-1783.AWSDNS-30.CO.UK Name Server: NS-459.AWSDNS-57.COM Name Server: NS-805.AWSDNS-36.NET <snip>
NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/6BU667JN...
Thank you all. I will reach out. I think we've disproved my first theory about what the issue is. Apologies for slow response, (trouble came in threes this week!) On Tue, Apr 7, 2026 at 12:05 PM Steve Sullivan via NANOG < nanog@lists.nanog.org> wrote:
Hey Mark,
Steve at DNS-OARC reaching out. I sent a note to the OP recommending she hit the OARC chat platform and mail list.
Cloudflare DNS is actually pretty active in the DNS-OARC Member and at-large Community. Might want send these operational DNS questions to the dns-operations mailing list and to https://chat.dns-oarc.net.
I try too when i see them, but I cannot read all the nanog mails.
I hope to see you at a workshop soon.
Kind regards,
Steve Sullivan Membership Coordinator OARC Mattermost Chat: @stevos https://linktr.ee/dnsoarc
On 4/6/2026 9:49 PM, marka via NANOG wrote:
On 7 Apr 2026, at 12:08, Betsy Schwartz via NANOG<nanog@lists.nanog.org>
We're getting reports of users trying to log in or request 2FA emails
Cloudflare sites (ex: California DMV) but seeing errors that our well.com domain isn't recognized as valid. Well.com has been around since 1993 and our primary DNS hasn't changed since perhaps 2012. . Excerpts appended for reference.
I strongly suspect these errors are related to a Cloudflare security check for valid email domains. Hoping someone here can validate or disprove this. If it's a Cloudflare issue, any contacts here?
When I poke at an open cloudflare DNS server and look up the A for well.com I get a disturbing error: : server can't find well.com.well.sf.ca.us:
well.sf.ca.us is an antique (but valid) A record in the sf.ca.us zone and has no business appearing here. Did something drop a period or CRLF on a list somewhere? Nslookup is NOT a good diagnostic tool. Here it presumably tried well.com
from then tried well.com.well.sf.ca.us when the first query failed as you have well.sf.ca.us in the search list. This is one of the reasons it is not a good diagnostic tool. Also different versions of nslookup move onto to applying the next name in the search list differently. The only SAFE? way to do search lists is to ONLY move to the next name on NXDOMAIN (Name Error). Lots of search list implementations move to the next name in the search
on SERVFAIL (you can get data from the wrong name used), NOERROR NODATA (you end up talking to different domains as IPv4 and IPv6 addresses appear/disappear).
I would suggest that you use a diagnostic tool like 'dig' which doesn’t do search lists unless explicitly requested.
Additionally if you want help, show everything you are doing. People
wrote: list then have
a better chance of find errors in your testing methodology.
When I query AWS and Google DNS servers, our DNS looks correct and unchanged Thank you very much for any pointers!
Betsy
-- Correct info:
set type=any well.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: well.com Address: 23.22.72.90 well.com nameserver = ns-1783.awsdns-30.co.uk. well.com nameserver = ns-1103.awsdns-09.org. well.com nameserver = ns-805.awsdns-36.net. well.com nameserver = ns-459.awsdns-57.com. well.com origin = ns-1103.awsdns-09.org mail addr = awsdns-hostmaster.amazon.com <snip> well.com mail exchanger = 15 xmx.well.com. <snip> -- whois well.com [Querying whois.verisign-grs.com] Domain Name: WELL.COM Registry Domain ID: 4562093_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.enom.com Registrar URL:http://www.enomdomains.com Updated Date: 2020-01-24T18:46:10Z Creation Date: 1993-01-25T05:00:00Z Registry Expiry Date: 2029-01-26T05:00:00Z <snip> Name Server: NS-1103.AWSDNS-09.ORG Name Server: NS-1783.AWSDNS-30.CO.UK Name Server: NS-459.AWSDNS-57.COM Name Server: NS-805.AWSDNS-36.NET <snip>
NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/6BU667JN...
NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/DCLCRZ2Q...
participants (6)
-
Alexander Huynh -
Betsy Schwartz -
Chris Adams -
marka -
Steve Sullivan -
Vinny Abello