Root Canary Test Results - All ServFail [Red Crosses]

[JemTheWire]

I recently Nuked my AX88U [full reset, NVRAM etc].

I did not restore settings from a backup, I wanted a pure clean install. I did, however, take screen shots of the relevant settings so I could manually enter them if/when required.

All is working very well with one weird exception. I have DoT set in my WAN settings using Cloudflare servers. DNSFilter is set to 'Router' but when check with RootCanary, every test shows a red cross.

I have attached sreenshots of my WAN settings.

Any advice please?

 

[dave14305]

I think it’s their problem. I’ve seen similar results the last couple days.

 

[Jack Yaz]

Looks like at least one of their certs expired 25/06/2020

 

[JemTheWire]

Thanks all.

It's Sod's Law that this happens just when you make changes yourself. It makes you doubt yourself.

 

[jerry6]

i'm all red as well , think they are not updated

 

[Mutzli]

Same here, I also made some changes and was wondering if I screwd up a setting. Good to know it's not my fault.

 

[SomeWhereOverTheRainBow]

I recently Nuked my AX88U [full reset, NVRAM etc].

I did not restore settings from a backup, I wanted a pure clean install. I did, however, take screen shots of the relevant settings so I could manually enter them if/when required.

All is working very well with one weird exception. I have DoT set in my WAN settings using Cloudflare servers. DNSFilter is set to 'Router' but when check with RootCanary, every test shows a red cross.

I have attached sreenshots of my WAN settings.

Any advice please?

View attachment 24345

View attachment 24346

I have seen this issue before with browser cache or computer dns cache not properly cleared before rerunning the test after having adjusted the routers dns settings.

 

[JemTheWire]

It could be but I don’t believe it’s the case this time. I have tried three separate devices plus a mobile phone with WiFi disabled so as to discount my WiFi.

 

[MDM]

Same here, on all browsers, they are down..!

 

[SheikhSheikha]

Use http://0skar.cz/dns/en/

 

[MDM]

 

[SheikhSheikha]

View attachment 24372

Check if turned on your DNS filter to Router (and leave the DNS fields blank on that page). You can find the tab under LAN.

 

[MDM]

Check if turned on your DNS filter to Router (and leave the DNS fields blank on that page). You can find the tab under LAN.

I use DoT, so yes the "Router" option is chosen. Also te DNS Rebind protection and DNSSEC are enabled too.
My settings are not the issue. This is just the result.
Oh and I have my Cable modem not in bridge-mode (my ISP do not allow it for home users) so DMZ is the second best option I can use. I do ton think this impacts the result...

 

[SheikhSheikha]

I use DoT, so yes the "Router" option is chosen. Also te DNS Rebind protection and DNSSEC are enabled too.
My settings are not the issue. This is just the result.
Oh and I have my Cable modem not in bridge-mode (my ISP do not allow it for home users) so DMZ is the second best option I can use. I do ton think this impacts the result...

Have you tried another DNS service Cloudfare? E.g. switch to google DNS and do the test again?

 

[New2This]

Working good here

https://www.cira.ca/cybersecurity-services/canadian-shield

 

[MDM]

Have you tried another DNS service Cloudfare? E.g. switch to google DNS and do the test again?

I use Cloudflare, just tried Google and this CIRA Canadian Shield; same result.
Like i guessed, my ISP modem/router must re-route all I set...

 

[SheikhSheikha]

I use Cloudfare, just tried Googleand and this CIRA Canadian Shield; same result.
Like i guessed, my ISP modem/router must re-route all I set...

that is a bummer.

 

[New2This]

My DNS filter to Router is set to off...
Running 149.112.121.20 and 149.112.122.20

 

[MDM]

My DNS filter to Router is set to off...
Running 149.112.121.20 and 149.112.122.20

Yes, tried those ones with private.canadianshield.cira.ca No go.
I don't know if the ISP-s router (HGW) is able to force its own DNS-s over mine? But i guess it is...

 

[MDM]

Hmmm, it seems it is not overtaken by ISP-s DNS:

I pass the test (when I naturally disable the Enable DNSSEC support setting do to known Cloudflare bug) so I gues DoT is working and my DNS is used, it also shows the local Cloudflare server address. Then I do not know why I fail the test...