--- title: archive.is stopped loading: EDNS Client Subnet | daily.dev description: A home DNS resolver (Blocky) was returning a dead IP for archive.is due to two compounding issues: ECS-stripping upstream resolvers (Quad9, NextDNS) causing... canonical: https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: archive.is stopped loading: EDNS Client Subnet | daily.dev og:description: A home DNS resolver (Blocky) was returning a dead IP for archive.is due to two compounding issues: ECS-stripping upstream resolvers (Quad9, NextDNS) causing... og:url: https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej og:image: https://api.daily.dev/og/posts/ib6pXv3Ej.png og:image:alt: archive.is stopped loading: EDNS Client Subnet og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # archive.is stopped loading: EDNS Client Subnet **[/dev/io](https://daily.dev/sources/iodev)** · 4 min read · 0 upvotes · 0 comments ## Summary A home DNS resolver (Blocky) was returning a dead IP for archive.is due to two compounding issues: ECS-stripping upstream resolvers (Quad9, NextDNS) causing archive.is's geo-steering to return a Vultr node with a closed port 443, and a configured `minTime` floor that pinned the bad answer for an hour instead of the intended 300-second TTL. The fix involved removing ECS-stripping upstreams and dropping the `minTime` cache floor, while keeping `maxTime` as a ceiling. The post also notes the privacy trade-off: forwarding EDNS Client Subnet leaks a truncated client prefix to every authoritative server, which is exactly what Quad9 and NextDNS deliberately avoid. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does my DNS resolver return a different IP for a CDN site than public resolvers do, and the IP it returns doesn't work? This happens when your upstream DNS resolver strips EDNS Client Subnet (ECS) before forwarding queries. CDN and geo-steered services like archive.is use ECS to return a nearby node. Without it, the authoritative server sees only the resolver's egress IP and may return a node mapped to that location — which can be an unrelated or unreachable host from your actual location. Resolvers like Quad9 and NextDNS strip ECS by design for privacy. _Developers running self-hosted resolvers hit this class of geo-steering failure more than they expect — others debugging the same on daily.dev._ ### What does the Blocky `minTime` setting do and why can it cause problems with CDN or failover DNS records? Blocky's `minTime` raises any TTL shorter than the configured floor to that minimum. CDN and geo-steered services intentionally publish short TTLs (e.g., 300 seconds) for fast failover and node rotation. A `minTime` of one hour pins a bad answer for the full hour instead of five minutes, turning a brief glitch into a prolonged outage for every client behind the resolver. Removing `minTime` and keeping only `maxTime` avoids this. _Self-hosters tuning DNS cache settings for reliability track these kinds of trade-offs on daily.dev._ ### Which DNS resolvers forward EDNS Client Subnet and which strip it? Quad9 and NextDNS strip ECS by deliberate privacy policy. AdGuard forwards ECS, including over DNS-over-QUIC at roughly 49 ms median. Google forwards ECS over DNS-over-TLS at roughly 67 ms with no QUIC endpoint. Quad9's dns11 variant and OpenDNS also forward ECS but apply filtering. When racing multiple upstreams, a single ECS-stripping entry is enough to cause intermittent geo-steering failures, so the upstream set must be uniform. _Choosing between privacy and geo-steering correctness in DNS is an ongoing trade-off developers discuss on daily.dev._ ## Similar posts on daily.dev - [Please stop using your ISP's DNS](https://daily.dev/posts/please-stop-using-your-isp-s-dns-m6xlgz7tr) · XDA Developers · 2 upvotes · 0 comments - [A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed](https://daily.dev/posts/a-broken-dnssec-rollover-took-down-al-now-1-1-1-1-tells-you-when-validation-is-bypassed-pbdskbvk7) · Cloudflare · 4 upvotes · 0 comments - [A Caddy Cert Expired Because systemd-resolved Was Selectively Broken](https://daily.dev/posts/a-caddy-cert-expired-because-systemd-resolved-was-selectively-broken-xkvx5lsal) · Lobsters · 1 upvotes · 0 comments - [The ghost domain problem in DNS, and what we're doing about it](https://daily.dev/posts/the-ghost-domain-problem-in-dns-and-what-we-re-doing-about-it-rbuad90xw) · Oh Dear · 0 upvotes · 0 comments - [How I Fixed the Biggest Annoyance of My Homelab](https://daily.dev/posts/how-i-fixed-the-biggest-annoyance-of-my-homelab-kmgwv3nk2) · It's Foss · 1 upvotes · 1 comments --- Tags: [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"archive.is stopped loading: EDNS Client Subnet","url":"https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej"},"datePublished":"2026-08-07T16:36:57.120Z","dateModified":"2026-08-07T16:37:27.706Z","description":"A home DNS resolver (Blocky) was returning a dead IP for archive.is due to two compounding issues: ECS-stripping upstream resolvers (Quad9, NextDNS) causing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f413bc5fd667c0ef2d21727d6d74d18e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f413bc5fd667c0ef2d21727d6d74d18e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"/dev/io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"/dev/io","logo":"https://media.daily.dev/image/upload/s--xOsuFPZX--/f_auto,q_auto/v1777801594/logos/iodev","url":"https://daily.dev/sources/iodev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"dns","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"/dev/io","item":"https://daily.dev/sources/iodev"},{"@type":"ListItem","position":3,"name":"archive.is stopped loading: EDNS Client Subnet"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/archive-is-stopped-loading-edns-client-subnet-ib6pxv3ej#faq","mainEntity":[{"@type":"Question","name":"Why does my DNS resolver return a different IP for a CDN site than public resolvers do, and the IP it returns doesn't work?","acceptedAnswer":{"@type":"Answer","text":"This happens when your upstream DNS resolver strips EDNS Client Subnet (ECS) before forwarding queries. CDN and geo-steered services like archive.is use ECS to return a nearby node. Without it, the authoritative server sees only the resolver's egress IP and may return a node mapped to that location — which can be an unrelated or unreachable host from your actual location. Resolvers like Quad9 and NextDNS strip ECS by design for privacy. Developers running self-hosted resolvers hit this class of geo-steering failure more than they expect — others debugging the same on daily.dev."}},{"@type":"Question","name":"What does the Blocky `minTime` setting do and why can it cause problems with CDN or failover DNS records?","acceptedAnswer":{"@type":"Answer","text":"Blocky's `minTime` raises any TTL shorter than the configured floor to that minimum. CDN and geo-steered services intentionally publish short TTLs (e.g., 300 seconds) for fast failover and node rotation. A `minTime` of one hour pins a bad answer for the full hour instead of five minutes, turning a brief glitch into a prolonged outage for every client behind the resolver. Removing `minTime` and keeping only `maxTime` avoids this. Self-hosters tuning DNS cache settings for reliability track these kinds of trade-offs on daily.dev."}},{"@type":"Question","name":"Which DNS resolvers forward EDNS Client Subnet and which strip it?","acceptedAnswer":{"@type":"Answer","text":"Quad9 and NextDNS strip ECS by deliberate privacy policy. AdGuard forwards ECS, including over DNS-over-QUIC at roughly 49 ms median. Google forwards ECS over DNS-over-TLS at roughly 67 ms with no QUIC endpoint. Quad9's dns11 variant and OpenDNS also forward ECS but apply filtering. When racing multiple upstreams, a single ECS-stripping entry is enough to cause intermittent geo-steering failures, so the upstream set must be uniform. Choosing between privacy and geo-steering correctness in DNS is an ongoing trade-off developers discuss on daily.dev."}}]} ```