Why am I getting a DNS 403 Forbidden Cloudflare error on one domain?

Technical Q&A
1

Hi, I have made the same DNS changes to 4 different domains

A record to 23.227.38.65

CNAME to shop.myshopify.com.

only 1 of the four domains is giving the 403 cloudflare issue, can you help me fix this issue?

The issue domain is: mijntelefoonhoesje.nl

These domains I have allready changed and are working OK

mijnsmartphonehoesje.nl
mijntablethoesje.nl
mijnipadhoesje.nl

Many thanks.

Kind regards Mark

2

Hi Mark!

I took a look at your domain’s DNS information and it looks like the domain has DNSSEC enabled. If this domain is hosted by Shopify please reach out to our live support and ask them to assist in disabling this. It may require an escalation to our technical team. Feel free to share this post with your live agent as reference.

If your domain is hosted by a third party, you will need to sign into your domain host admin to manage the domain and disable DNSSEC.

3

Hi,

Thanks for your reply.
This domain (all 4 domains) are hosted at a third party, and all four
domains have DNSSEC disabled. I just checked, could this maybe be an SSL
issue at your side?
I saw this error at more forums which pointed to ssl issue a couple of
times, just a suggestion I don’t know what it is that why I am contacting
you :slightly_smiling_face:

Thnks in advance.

4

Thank you for confirming that for me Mark!

Are you able to send me a screenshot of that domain’s DNS information to review? I also have a few questions to help troubleshoot this as well:

  • How long ago did you add this domain or make changes to the DNS information? It can take up to 48 hours for the DNS to finish updating (although it can be done sooner).
  • Do you have more than one A record in your DNS list? If yes, please remove it as it can cause issues.
  • Did you have DNSSEC enabled previously at all?
5

[image: image.png]

To be honest I did this a few hours back, but a month ago I did the same
and after 7 days I still had the same issue. For all 4 domains I have these
exact same DNS settings, but only one is failing. I checked with
dnschecker and seems dns changes are already updated globally.
For DNSSEC I don’t know but checked with this tool
https://dnssec-debugger.verisignlabs.com/mijntelefoonhoesje.nl and seems
all the same as for the shops primary domain.

6

I used a couple of free tools and some reported valid DNSSEC enabled and some did not. I would definitely reach out to your domain first to confirm that DNSSEC is fully disabled on their end. Since multiple tools are reporting that DNSSEC is enabled on this domain, we need them to check that first.

If they also confirm that DNSSEC is fully disabled on that domain, then definitely reach out to our live support to ensure that this is not an issue with Cloudflare and SSL propagation.

Reference: Website test: mijntelefoonhoesje.nl

7

Hi,

I have reached out with my domain party support and DNSSEC is now fully
disabled for the specific domain “mijntelefoonhoesje.nl”.
The same issue still remains, as you mentioned can you insure that this is
not an issue with Cloudflare and SSL propagation?

Sorry for my late response, I had to wait 5 days from my domain provider,
and then became a dad for the second time, so was kind of busy :wink:

Thanks for your help.

Kind regards Mark

8

Hi Mark!

Congratulations on the new family addition! That’s incredible news.

Regarding your domain problem, I am still seeing the issue persisting on my end as well. In this scenario you will need to reach out to our live support for the next troubleshooting steps. You can also reply back to your most recent billing email create a ticket for this issue. I would recommend sharing the link to this community forum post with your support advisor so they know that you have already done some troubleshooting to try and resolve this.