Search code examples
dnscloudflareamazon-elbaws-application-load-balancer

Unable to associate the Amazon Load Balancer with a subdomain on Cloudflare

I have the Amazon Load Balancer. I tried to make one of my subdomains redirect requests to the load balancer. Following this doc (point Amazon ELB (Elastic Load Balancing)) I've created a new CNAME record in my domain on Cloudflare:

  • Type: CNAME
  • Name: api
  • Target: xxx.us-east-2.elb.amazonaws.com
  • TTL: auto
  • Proxy status: DNS only

enter image description here

I waited >24 hours and I still get nothing on api.mydomain.com. I checked 3 addresses and got:

Check the load balancer (OK):

$ nslookup xxx.us-east-2.elb.amazonaws.com

Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   xxx.us-east-2.elb.amazonaws.com
Address: 3.xx.xx.255
Name:   xxx.us-east-2.elb.amazonaws.com
Address: 3.xx.xx.165

Check the main domain (OK):

$ nslookup mydomain.com

Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   mydomain.com
Address: 108.xx.xx.71

Check the new subdomain (NOTHING):

$ nslookup api.mydomain.com

Server:         192.168.1.1
Address:        192.168.1.1#53

** server can't find api.mydomain.com: NXDOMAIN

Questions:

  1. Should I do an additional setup to make it work?
  2. Why does nslookup api.mydomain.com return nothing? Doesn't it look like the subdomain wasn't created, so the problem isn't the connection between the load balancer and Cloudflare, but that Cloudflare hasn't created the subdomain?
  3. By the link (point AWS nameserver updates) I can find the instruction for adding nameserver records to Route 53, but I cannot find any info on how it helps me. I've replaced the default NS records of the domain on "Hosted zones" (AWS) with the two NS records from my Cloudflare domain, but no effect. Do I need to configure Route 53 to make the load balancer work with Cloudflare (I don't use Route 53 for anything)?
  4. I've enabled the "Flexible" SSL/TLS encryption mode on Cloudflare. I need the Flexible encryption for the main domain and don't need it for the subdomains, because they have their own SSL. Can this affect the problem?
Solution

  • The problem was in poorly performed migration from OVH to Cloudflare by a previous developer. I'm putting here the way that helped me to find the root of the cause in case if it will help someone else.

    What I did:

    1. I checked the subdomain api.mydomain.com and saw the response Status: NXDOMAIN. But if I have correctly set up the CNAME to the AWS ELB as grey-clouded (DNS-only), I should get amazon IPs back from the resolver. Checker: http://dig.ping.pe/api.mydomain.com:NS:1.1.1.1
    2. I checked the NS records of my domain and realized they are pointing to OVH and not on Cloudflare. Checker: http://dig.ping.pe/mydomain.com:NS:1.1.1.1
    3. To make it work on Cloudflare, I have to visit the domain registrar and change the NS: Changing your domain nameservers to Cloudflare

    Answering my own questions:

    1. Should I do an additional setup to make it work? Nope. Adding the CNAME record is enough.

    2. Why does nslookup api.mydomain.com return nothing? Because the subdomain wasn't created.

    3. Do I need to configure Route 53 to make the load balancer work with Cloudflare? No, you don't need it.

    4. Can SSL/TLS affect the problem? No