I have a strange issue where some services take a really long time to load but once they start loading they run at normal speed. The most consistent example I have found is soundcloud. When I go to soundcloud.com the page loads like normal but when I play a song it gets stuck loading for a very long time. I can see in the firefox network tab that its stuck loading cf-hls-media.sndcdn.com

I attempted to look up the domain manually and got

user@desktop:~$ nslookup cf-hls-media.sndcdn.com
;; connection timed out; no servers could be reached

I changed my DNS from my ISPs server to but I still have the same issue. The DNS does seem to have changed as some domains that were blocked on my ISPs server are not working again but still the same issue with soundcloud and a lot of other domains (It seems to be the same ones that usually work and usually don't, usually CDNs seem to be the broken domains from what I have seen)

Speed tests and ping tests all show everything working as normal so I'm not really sure where to go from here.

Edit: I did some more tests and found that nslookup times out but dig finds the domain.

  • Nitpick: When you say you changed your DNS to stop using your ISPs server, was that a setting on your computer? Most people, their computer uses automatically assigned DNS from their router, which in turn uses the DNS from the ISP. The DNS resolver/forwarder on the router can be buggy, so we want to know that you tested directly on your computer. – sourcejedi May 29 '17 at 7:40
  • try a vpn to exclude to a certain degree local configuration; try dnscrypt to exclude your ISP intercepting DNS; use dnstrace and paste the output. Add your country, ISP and your type of connection (cable?); tell us if you are using wifi and wifi tech; tell us the brand of yout wifi card; are you sharing the connection or sole user? – Rui F Ribeiro May 29 '17 at 7:42
  • Seconding: country, ISP, connection type (and use of wifi or not). I thought about hijacking of, but I didn't remember the reason at first. In some countries, the google public DNS servers are a bypass for cheap censorship implementations, and therefore some countries are known to hijack these IP addresses. – sourcejedi May 29 '17 at 8:05
  • @sourcejedi I changed the settings on my desktop, When I run nmcli dev show | grep DNS it shows googles DNS addresses. – Qwertie May 29 '17 at 9:06
  • Per dnsviz.net/d/cf-hls-media.sndcdn.com/WS3lgg/dnssec there are warnings and errors in the configuration of DNS related to cf -hls-media.sndcdn.com ; if you have issues only with this hostname the problem may be on their end and not yours. – Patrick Mevzek May 30 '17 at 21:38

In case your network is deliberately doing bad things to DNS, you could try to use the fallback tunnel support in dnssec-trigger. This includes an encrypted tunnel over port TCP 443. The upstream project provides default tunnel endpoints on a best-effort basis. E.g. in the upstream project, see ssl443 in example.conf.in.

I've only seen this documented; I've never tried to use the fallback tunnelling. dnssec-trigger should log what method it is using, i.e. whether the fallback is active. dnssec-trigger does not seem to document what exactly will trigger the fallback, nor a way to force its use.

This will also switch you to using a validating DNSSEC resolver. Domains which configured DNSSEC but got it wrong or something will fail. This should be significantly less common that the problem you describe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.