{"id":683,"date":"2022-11-07T12:44:39","date_gmt":"2022-11-07T12:44:39","guid":{"rendered":"https:\/\/www.quppa.net\/blog\/?p=683"},"modified":"2022-12-14T05:15:55","modified_gmt":"2022-12-14T05:15:55","slug":"teamviewer-dnssec-broken","status":"publish","type":"post","link":"https:\/\/www.quppa.net\/blog\/2022\/11\/07\/teamviewer-dnssec-broken\/","title":{"rendered":"TeamViewer (sometimes) doesn’t work with DNSSEC enabled"},"content":{"rendered":"\n

Update (2022-12-06):<\/em> It looks like TeamViewer fixed their DNS config (before<\/a> and after<\/a>).<\/p>\n\n\n\n

Update (2022-11-12): <\/em>I tested again after Frankie in the comments noted that it works on his machine, and indeed it does for me, too, even with DNSSEC turned back on. My only explanation is that it’s an intermittent issue.<\/p>\n\n\n\n

I couldn’t figure out why TeamViewer was perpetually stuck in the ‘Not ready. Please check your connection’ state, and the help article<\/a> didn’t give any clues (port 5938 was already open for outbound connections).<\/p>\n\n\n\n

\"\"
The dreaded ‘Not ready. Please check your connection’<\/figcaption><\/figure>\n\n\n\n

The log files (\/opt\/teamviewer\/logfiles\/TeamViewer15_Logfile.log<\/code> in Fedora) gave a hint:<\/p>\n\n\n\n

S!! HttpRequestImpl::CurlFinished(): curl request failed: Couldn't resolve host name (6), Could not resolve host: router1.teamviewer.com, Errorcode=97\nS!! CHttpConnectionOutgoing::ResolveDNSName: resolving DNS name failed, status = Failed, HTTP response code = 0, URL = 'http:\/\/router1.teamviewer.com\/cname.aspx', Errorcode=97\nS!! CHttpConnectionOutgoing::HandleResolveDNS: empty address, m_ConnectionState=0, Errorcode=97\nS!  CProcessCommandHandlerKeepAlive[308]::HandleKeepAliveConnect(): Connect to KeepAliveServer failed\nS!!!KeepAliveSessionOutgoing::ConnectFailureHandler(): KeepAliveConnect to router1.teamviewer.com failed, Errorcode=97<\/code><\/pre>\n\n\n\n
The host would cycle from router1.teamviewer.com<\/code> to router16.teamviewer.com<\/code>, but none of them would resolve. Long story short, DNSSEC is broken<\/a> for these TeamViewer domains, and the application won’t work if none of them can be reached.<\/p>\n\n\n\n
Sadly, this problem was reported years<\/a> ago<\/a> but nothing has changed.<\/p>\n\n\n\n
Workarounds<\/h2>\n\n\n\n
Neither of these is good! I recommend contacting TeamViewer<\/a> and letting them know about this issue (particularly if you’re a paying customer).<\/p>\n\n\n\n
Hard code an IP address in hosts<\/code><\/h3>\n\n\n\n
Adding an IP address for router1.teamviewer.com<\/code> to hosts<\/code> seems to make the application functional.<\/p>\n\n\n\n
> host router1.teamviewer.com 1.1.1.1\nUsing domain server:\nName: 1.1.1.1\nAddress: 1.1.1.1#53\nAliases: \n\nrouter1.teamviewer.com is an alias for routerpool1.rlb.teamviewer.com.\nrouterpool1.rlb.teamviewer.com has address 37.252.244.151\nrouterpool1.rlb.teamviewer.com has address 37.252.244.143\nrouterpool1.rlb.teamviewer.com has address 188.172.203.45\nrouterpool1.rlb.teamviewer.com has address 188.172.208.134\nrouterpool1.rlb.teamviewer.com has address 217.146.12.138\nrouterpool1.rlb.teamviewer.com has IPv6 address 2a00:11c0:28:351:217:146:11:108\nrouterpool1.rlb.teamviewer.com has IPv6 address 2a00:11c0:12:351:188:172:208:142\nrouterpool1.rlb.teamviewer.com has IPv6 address 2a00:11c0:13:351:37:252:244:135\nrouterpool1.rlb.teamviewer.com has IPv6 address 2a00:11c0:27:351:213:227:184:141\nrouterpool1.rlb.teamviewer.com has IPv6 address 2a00:11c0:45:351:217:146:12:138<\/code><\/pre>\n\n\n\n
I just picked the first IPv4 address and added it to \/etc\/hosts<\/code>:<\/p>\n\n\n\n
37.252.244.151 router1.teamviewer.com<\/code><\/pre>\n\n\n\n
These IP addresses are of course liable to change.<\/p>\n\n\n\n
Disable DNSSEC<\/h3>\n\n\n\n
Note:<\/strong> DNSSEC exists for a reason<\/a> – don’t disable it unless absolutely necessary.<\/em><\/p>\n\n\n\n
The nuclear option is to turn off DNSSEC checks entirely, or switch to using DNS servers that don’t support it in the first place (I recommend neither).<\/p>\n\n\n\n
On Fedora 36 with systemd-resolved<\/a><\/code>, this means editing \/etc\/systemd\/resolved.conf<\/code> and adding DNSSEC=no<\/code> under [Resolve]<\/code>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Update (2022-12-06): It looks like TeamViewer fixed their DNS config (before and after). Update (2022-11-12): I tested again after Frankie in the comments noted that it works on his machine, and indeed it does for me, too, even with DNSSEC turned back on. My only explanation is that it’s an intermittent issue. I couldn’t figure … Continue reading “TeamViewer (sometimes) doesn’t work with DNSSEC enabled”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":684,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4,9],"tags":[201,198,200,193,202,199],"class_list":["post-683","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-miscellaneous","category-windows","tag-cloudflare","tag-dns","tag-dnssec","tag-fedora","tag-google","tag-teamviewer"],"_links":{"self":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts\/683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/comments?post=683"}],"version-history":[{"count":7,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts\/683\/revisions"}],"predecessor-version":[{"id":697,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts\/683\/revisions\/697"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/media\/684"}],"wp:attachment":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/media?parent=683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/categories?post=683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/tags?post=683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}