GitBook bypassing Cloudflare DNS to route traffic to their domain

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @12:28AM (#33715577)

I experienced this today when migrating away from GitBook and I thought I was going crazy.

I had changed the CNAME pointing to GitBook to my new service, and dig etc was reporting that it had propagated correctly. BUT the URL was still resolving to GitBook.

I was pulling my hair out and questioning my entire understanding of how DNS works.

From what I can tell Cloudflare "partners" can introduce redirect rules that are prioritized over our own Cloudflare DNS rules. This sounds completely insane to me, there's no way SaaS providers should be able to hijack control of DNS like this.

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @12:31AM (#33715599)

You can see this yourself by running a "dig" against help.leavemealone.app, the DNS resolution and where the domain actually routes to is different.

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by aussiedude on Wednesday November 23, 2022 @01:28AM (#33715903)

I was honestly confused for a bit, then realised that your site was redirecting to Gitbook.

;; ANSWER SECTION: help.leavemealone.app. 0 IN CNAME help.leavemealone.com.

help.leavemealone.com. 0 IN CNAME leavemealone.helpkit.so.

leavemealone.helpkit.so. 0 IN CNAME helpkit-ssr.onrender.com.

helpkit-ssr.onrender.com. 0 IN CNAME helpkit-ssr.onrender.com.cdn.cloudflare.net.

helpkit-ssr.onrender.com.cdn.cloudflare.net. 0 IN A 216.24.57.3

helpkit-ssr.onrender.com.cdn.cloudflare.net. 0 IN A 216.24.57.253

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @01:32AM (#33715920)

Yes. DNS shows it should be redirecting to leavemealone.helpkit.so but it actually redirects to dinkydani.gitbook.io

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by bauruine on Wednesday November 23, 2022 @02:10AM (#33716122)

help.leavemealone.com. is a CNAME to leavemealone.helpkit.so which again is a CNAME to helpkit-ssr.onrender.com. and so forth till you get the A records. Your browser then connects to that IP and there you get the 302 redirect. I'm still not sure what I should see here.

EDIT: This is a CNAME chain and although it's not recommended it's valid https://serverfault.com/a/309660

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @02:22AM (#33716194)

The A records that you've gotten to are unrelated to Gitbook and there are no 302 redirects on our side. As far as I understand it's some internal redirect happening in Cloudflare's network.

You can read more info here: https://community.cloudflare.com/t/dns-subdomain-no-longer-w...

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by bauruine on Wednesday November 23, 2022 @03:03AM (#33716431)

Thanks for the explanation. I still don't know exactly what's going on here. How do the DNS records look on the Cloudflare UI?

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @03:54AM (#33716729)

help.leavemealone.app -> CNAME -> help.leavemealone.com -> CNAME -> leavemealone.helpkit.so

Gitbook is nowhere in the chain

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by bauruine on Wednesday November 23, 2022 @04:04AM (#33716798)

Then you have to ask helpkit.so why they are using render.com to do the redirect.

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by bauruine on Wednesday November 23, 2022 @04:29AM (#33716981)

But it's hitting their DNS zone and they have decided to add a CNAME to helpkit-ssr.onrender.com for leavemealone.helpkit.so.

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @04:24AM (#33716939)

The request is never hitting HelpKit's servers.

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by bauruine on Wednesday November 23, 2022 @01:32AM (#33715917)

The domains resolves to an IP announced by AS397273 (https://render.com/) the web server at this IP returns a 302 redirect to https://dinkydani.gitbook.io/leave-me-alone-help/. What exactly can I see here?

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by jivings on Wednesday November 23, 2022 @01:52AM (#33716017)

Try doing a curl on the domain that's returned by the CNAME and comparing it to a curl on the original URL. I agree it makes no sense so I don't blame you for assuming it's nonsense.

There's a redirect happening somewhere but it ain't from the web server listed on the DNS record.

[ Parent | on HN ]

Re:GitBook bypassing Cloudflare DNS to route traffic to thei... by zupa-hu on Wednesday November 23, 2022 @03:50AM (#33716700)

I agree with @aussiedude that I don't see anything suspicious.

Authorative A records:

# help.leavemealone.app

help.leavemealone.app. 60 IN CNAME help.leavemealone.com.

# help.leavemealone.com

help.leavemealone.com. 30 IN CNAME leavemealone.helpkit.so.

# leavemealone.helpkit.so

leavemealone.helpkit.so. 1799 IN CNAME helpkit-ssr.onrender.com.

# helpkit-ssr.onrender.com

helpkit-ssr.onrender.com. 300 IN CNAME helpkit-ssr.onrender.com.cdn.cloudflare.net.

# Authorative A records for helpkit-ssr.onrender.com.cdn.cloudflare.net:

helpkit-ssr.onrender.com.cdn.cloudflare.net. 300 IN A 216.24.57.3 helpkit-ssr.onrender.com.cdn.cloudflare.net. 300 IN A 216.24.57.253

Indeed opening the page loads 216.24.57.3 where I get a HTTPS response with statusCode 302 that redirects to -> https://dinkydani.gitbook.io/leave-me-alone-help/

Seems to be what should happen?

ps - I'm stunned though to see 4 CNAMEs, especially with 60 and 30s TTLs

[ Parent | on HN ]