<div dir="ltr">I would guess the <i>upstream </i>server used by resolved is reacting negatively to weirdness in O365 authoritative DNS.<div><br></div><div>* <font face="monospace"><a href="http://outlook.office365.com" target="_blank">outlook.office365.com</a></font> is indeed an alias (CNAME) for <font face="monospace"><a href="http://outlook.ha.office365.com" target="_blank">outlook.ha.office365.com</a></font>.</div><div>* The domain <font face="monospace"><a href="http://ha.office365.com" target="_blank">ha.office365.com</a></font> has two sets of nameservers: <font face="monospace">ns{1..4}-<a href="http://ms-acdc.office.com" target="_blank">ms-acdc.office.com</a></font> and <font face="monospace">tm{1..2}.<a href="http://edgedns-tm.info" target="_blank">edgedns-tm.info</a></font>, which don't seem to agree with each other.</div><div>* According to the first set of nameservers, <font face="monospace"><a href="http://outlook.ha.office365.com" target="_blank">outlook.ha.office365.com</a></font> is a two-layer alias for <font face="monospace"><a href="http://outlook.ms-acdc.office.com" target="_blank">outlook.ms-acdc.office.com</a></font> and then <font face="monospace"><a href="http://FRA-efz.ms-acdc.office.com" target="_blank">FRA-efz.ms-acdc.office.com</a></font>.</div><div>* But according to the second set of nameservers, <font face="monospace"><a href="http://outlook.ha.office365.com" target="_blank">outlook.ha.office365.com</a></font> is <i>not</i> an alias -- those servers perform some sort of CNAME flattening and directly return A/AAAA records. (Though if you ask them very nicely for CNAME records, they will actually admit that it's an alias for <font face="monospace"><a href="http://fra-mvp.trafficmanager.net" target="_blank">fra-mvp.trafficmanager.net</a></font>... which is different again.)</div><div><br></div><div>So it is entirely possible that when resolved makes two queries, one for A records and another for AAAA, it receives conflicting information about the target simultaneously being an alias and not being an alias (due to your upstream resolver choosing different NS each time), and I wouldn't be surprised if that causes resolved to reject (or just overlook) some of the returned DNS records.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 27, 2021 at 12:11 PM Stefan Tatschner <<a href="mailto:stefan@rumpelsepp.org" target="_blank">stefan@rumpelsepp.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Heya,<br>
<br>
I was confronted with a weird problem this morning. On my location<br>
there is only IPv4 available. My company uses the shiny new Office365<br>
service for email. This morning I was not able to connect to my email<br>
account. The reason was systemd-resolved returning only IPv6 addresses<br>
for the email host:<br>
<br>
$ resolvectl query <a href="http://outlook.office365.com" rel="noreferrer" target="_blank">outlook.office365.com</a><br>
<a href="http://outlook.office365.com" rel="noreferrer" target="_blank">outlook.office365.com</a>: 2603:1026:c0a:855::2 -- link: enp3s0<br>
2603:1026:c0a:857::2 -- link: enp3s0<br>
2603:1026:c0a:8b7::2 -- link: enp3s0<br>
2603:1026:c0a:850::2 -- link: enp3s0<br>
2603:1026:c0a:852::2 -- link: enp3s0<br>
2603:1026:c0a:851::2 -- link: enp3s0<br>
2603:1026:101:1::2 -- link: enp3s0<br>
2603:1026:c0a:854::2 -- link: enp3s0<br>
(<a href="http://outlook.ha.office365.com" rel="noreferrer" target="_blank">outlook.ha.office365.com</a>)<br>
<br>
-- Information acquired via protocol DNS in 820us.<br>
-- Data is authenticated: no<br>
<br>
The `host` utility instead reports this:<br>
<br>
$ host <a href="http://outlook.office365.com" rel="noreferrer" target="_blank">outlook.office365.com</a><br>
<a href="http://outlook.office365.com" rel="noreferrer" target="_blank">outlook.office365.com</a> is an alias for <a href="http://outlook.ha.office365.com" rel="noreferrer" target="_blank">outlook.ha.office365.com</a>.<br>
<a href="http://outlook.ha.office365.com" rel="noreferrer" target="_blank">outlook.ha.office365.com</a> is an alias for <a href="http://outlook.ms-acdc.office.com" rel="noreferrer" target="_blank">outlook.ms-acdc.office.com</a>.<br>
<a href="http://outlook.ms-acdc.office.com" rel="noreferrer" target="_blank">outlook.ms-acdc.office.com</a> is an alias for <a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a>.<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has address 40.101.12.66<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has address 52.97.250.210<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has address 40.101.121.34<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has address 52.97.155.114<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has IPv6 address 2603:1026:c03:581b::2<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has IPv6 address 2603:1026:207:177::2<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has IPv6 address 2603:1026:207:64::2<br>
<a href="http://AMS-efz.ms-acdc.office.com" rel="noreferrer" target="_blank">AMS-efz.ms-acdc.office.com</a> has IPv6 address 2603:1026:206:4::2<br>
<br>
The problem was that systemd-resolved only returned ipv6 addresses<br>
although I have no ipv6 connectivity. Why does this happen? Is there an<br>
artificial max. addresses limit with the sorting rule ipv6 first in<br>
systemd-resolved?<br>
<br>
I work-arounded it with an entry in /etc/hosts for now.<br>
<br>
Stefan<br>
<br>
_______________________________________________<br>
systemd-devel mailing list<br>
<a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a><br>
<a href="https://lists.freedesktop.org/mailman/listinfo/systemd-devel" rel="noreferrer" target="_blank">https://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr">Mantas Mikulėnas</div></div>