GitHub Pages DNS check fails with Dnsruby::ResolvTimeout

[DalniyX]

🏷️ Discussion Type

Bug

Body

Hello,

I am experiencing a GitHub Pages custom domain DNS verification issue.

Repository:
https://github.com/DalniyX/narrata-releases

Custom domain:
narrata.space

GitHub Pages source:
main branch, /docs

The Pages build is successful:

• Pages status: built
• Latest Pages build status: built
• Custom domain: narrata.space

DNS has been independently verified using both Google Public DNS and Cloudflare DNS.

For narrata.space, both resolvers return exactly the four GitHub Pages IP addresses:

185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153

For www.narrata.space:

www.narrata.space → CNAME → dalniyx.github.io

and dalniyx.github.io resolves to the same four GitHub Pages IP addresses.

There are no AAAA records and no CAA records.

Authoritative nameservers:

ns1.reg.ru
ns2.reg.ru

The CNAME file is present in the /docs publishing source and contains only:

narrata.space

I also removed and re-added the custom domain in GitHub Pages to restart the verification/provisioning process.

However, GitHub's Pages health API repeatedly reports:

dns_resolves: false
is_pointed_to_github_pages_ip: false
is_valid: false
reason: InvalidDNSError
caa_error: Dnsruby::ResolvTimeout

The same result occurs for both narrata.space and www.narrata.space.

I also triggered a fresh health check. The first request returned HTTP 202, and after the background check completed the subsequent request returned HTTP 200 with the same DNS error.

The important part is that Google Public DNS and Cloudflare DNS both resolve the domain correctly, while GitHub's own Pages DNS health check cannot retrieve the DNS records.

Could someone help determine why GitHub Pages' DNS checker is returning Dnsruby::ResolvTimeout for this domain?

Thank you.

Update:

I performed additional independent DNS checks.

Google Public DNS:

• CAA query: Status 0, no CAA answer, valid SOA returned
• SOA query: Status 0, valid SOA returned

Cloudflare DNS:

• CAA query: Status 0, no CAA answer, valid SOA returned

However, GitHub Pages health still reports:

narrata.space:
caa_error: Dnsruby::ServFail

www.narrata.space:
caa_error: Dnsruby::ResolvTimeout

The public DNS resolvers therefore return a normal negative CAA response, while GitHub's resolver reports SERVFAIL/timeout.

Could this indicate a resolver compatibility issue between GitHub Pages' DNS checker (Dnsruby) and the authoritative DNS servers for the domain?

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[bosmdavid-gif]

Not a fix on GitHub's side, but a pattern and a workaround. At least three Pages threads this week have ns1/ns2.reg.ru as the authoritative nameservers and a check that times out or never leaves "new": this one, #209098 (malinaklubnika.ru) and #208719 (app.ostepanovva.ru). Public resolvers answering fine while Dnsruby gets ServFail/timeouts on CAA suggests GitHub's resolver can't reliably reach those nameservers. Your records, as you describe them, look fine.

Things worth trying:

1. Query the authoritative servers directly, UDP and TCP: dig @ns1.reg.ru narrata.space CAA and again with +tcp. A hang or SERVFAIL on either matches the error.
2. Run the domain through letsdebug.net, which does Let's Encrypt-style checks from outside.
3. Workaround: keep reg.ru as registrar but move DNS hosting elsewhere (e.g. Cloudflare's free DNS, records set to DNS only). Recreate the four A records and the www CNAME, switch the nameservers at reg.ru, wait until dig NS narrata.space shows the new ones, then remove and re-add the custom domain once.

If you try 3, posting the result would help the other two threads too.