Esoteric taxpayer website

[sergeevabc]

There have been a lot of changes in Russia's digital infrastructure of late. And it's not always clear to me whether I'm facing another state imposed ban, the incompetence of some website admin, or an outdated resolver. For example, just a few DNSCrypt resolvers mentioned in resolvers.md allow me to get data about lkfl2.nalog.ru (taxpayer website), other resolvers fail. Any ideas why?

Resolves via AdGuard and Serbica (rare exceptions)

$ doggo lkfl2.nalog.ru @sdns://AQMAAAAAAAAAETk0LjE0MC4xNC4xNDo1NDQzINErR_JS3PLCu_iZEIbq95zkSV2LFsigxDIuUso_OQhzIjIuZG5zY3J5cHQuZGVmYXVsdC5uczEuYWRndWFyZC5jb20
NAME                 TYPE   CLASS  TTL    ADDRESS                       NAMESERVER
lkfl2.nalog.ru.      CNAME  IN     3451s  lkfl21.gi.nalog.ru.           94.140.14.14:5443
lkfl21.gi.nalog.ru.  A      IN     60s    213.24.64.175                 94.140.14.14:5443
lkfl2.nalog.ru.      CNAME  IN     1751s  lkfl21.gi.nalog.ru.           94.140.14.14:5443
gi.nalog.ru.         SOA    IN     2168s  gtmd.gi.nalog.ru.             94.140.14.14:5443
                                          dns.fcod.nalog.ru.
                                          2025092801 10800 3600 604800
                                          86400

$ doggo lkfl2.nalog.ru @sdns://AQcAAAAAAAAAEzE4NS42Ni4xNDMuMTc4OjUzNTMg-Y2MQmGOXiggAEKulN-ITGEn_Kj3TIP1UK1X2wh3o7wXMi5kbnNjcnlwdC1jZXJ0LnNlcmJpY2E
NAME                 TYPE   CLASS  TTL  ADDRESS                       NAMESERVER
lkfl2.nalog.ru.      CNAME  IN     30s  lkfl21.gi.nalog.ru.           185.66.143.178:5353
lkfl21.gi.nalog.ru.  A      IN     30s  213.24.64.175                 185.66.143.178:5353
lkfl2.nalog.ru.      CNAME  IN     30s  lkfl21.gi.nalog.ru.           185.66.143.178:5353
gi.nalog.ru.         SOA    IN     30s  gtmd.gi.nalog.ru.             185.66.143.178:5353
                                        dns.fcod.nalog.ru.
                                        2025092801 10800 3600 604800
                                        86400

Does not resolve via Quad9, Scaleway and many others

$ doggo lkfl2.nalog.ru @sdns://AQYAAAAAAAAADTkuOS45LjEwOjg0NDMgZ8hHuMh1jNEgJFVDvnVnRt803x2EwAuMRwNo34Idhj4ZMi5kbnNjcnlwdC1jZXJ0LnF1YWQ5Lm5ldA
NAME  TYPE  CLASS  TTL  ADDRESS  NAMESERVER

$ doggo lkfl2.nalog.ru @sdns://AQcAAAAAAAAADTUxLjE1LjEyMi4yNTAg6Q3ZfapcbHgiHKLF7QFoli0Ty1Vsz3RXs1RUbxUrwZAcMi5kbnNjcnlwdC1jZXJ0LnNjYWxld2F5LWFtcw
level=ERROR msg="Error looking up DNS records" error="context deadline exceeded"

[jedisct1]

I'm unable to resolve it from France, even with my regular ISP resolver, without dnscrypt.

It doesn't work from the Netherlands either.

Even Cloudflare doesn't want to provide a response:

dig lkfl2.nalog.ru @1.1.1.1
; EDE: 22 (No Reachable Authority)
;lkfl2.nalog.ru.                        IN      A

While for some reason, it works from Singapore.

The authoritative DNS server fornalog.ru has the ability to respond only to resolvers from certain countries.

This is likely what they do.

You probably need to setup a dnscrypt-proxy forwarding rule specifically for such domains, so that they are resolved by your ISP resolvers.

[sergeevabc]

The authoritative DNS server fornalog.ru has the ability to respond only to resolvers from certain countries.

I thought so too initially… But the weird thing is that it responds to serbica (located in Netherlands), yet does not respond to cs-nl, dnscry.pt-amsterdam-ipv4 and scaleway-ams (also Netherlands).

You probably need to setup a dnscrypt-proxy forwarding rule specifically for such domains…

Yes, that's exactly what my comrades do at present. But this means using unsecured DNS requests, because forwarding does not allow redirecting the request to the specified stamp (e.g. DNSCrypt resolver that works such as mentioned AdGuard or Serbica).

[jedisct1]

IP-to-location databases are never fully accurate. It's possible that serbica maps to Russia in the database they use.