Cloudflare DNS - why is it bad?

[perrygovier]

I'm getting ready to start moving some of our sites over to Vercel, but I'd like to understand the "why" behind the recommendations on the Domains tab. Some of our sites could be moved over entirely, but some must remain behind Cloudflare. Is there a way to use the Zeit/Vercel CDN and have the full suite of performance/speed enhancements while keeping Cloudflare as our DNS?

[rauchg]

Cloudflare strips the standard EDNS metadata from their queries (therefore breaking the DNS protocol), which makes geo-routing hit and miss.

We are working on a solution as part of improvements to our edge network to fix Cloudflare's oddities and problems.

For more context, this is also why archive.is doesn't work on 1.1.1.1:
https://twitter.com/archiveis/status/1018691421182791680

[ltm]

Cloudflare strips the standard EDNS metadata from their queries (therefore breaking the DNS protocol), which makes geo-routing hit and miss.

EDNS is by definition an extension to DNS and therefore omitting the metadata does not break DNS. In fact, RFC 7871 recommends against using EDNS Client Subnet due to privacy concerns:

We recommend that [EDNS Client Subnet] be turned off by default in all nameserver software, and that operators only enable it explicitly in those circumstances where it provides a clear benefit for their clients.

For more context, this is also why archive.is doesn't work on 1.1.1.1:
https://twitter.com/archiveis/status/1018691421182791680

No, archive.is does not work on 1.1.1.1 because archive.is went out of their way to break it. They intentionally return invalid results when queried by the Cloudflare resolver.

[balupton]

We are working on a solution as part of improvements to our edge network to fix Cloudflare's oddities and problems.

Is there any ETA on this? As I use cloudflare workers heavily, and have no intention of removing the cloudflare proxy.

So in the meantime, https://staticsitegenerators.net isn't getting updates:

bevry/staticsitegenerators-website@43074bc#commitcomment-39319705

(update: in the end, I just disabled the cloudflare proxy for that domain, as that domain got lucky as doesn't use any cloudflare workers)