4 data sources have stale URLs due to domain migration (DNS NXDOMAIN)

[mingcha-dev]

Problem

Full DNS scan of all 541 FirstData domains (via dns.google + dns.alidns.com cross-validation) found 4 domains returning NXDOMAIN — the domains no longer exist. All 4 are confirmed domain migrations (the organizations moved to new domains).

Affected Sources

Source File	Old Domain (NXDOMAIN)	New Domain (verified)	Organization
china/governance/china-cnao.json	www.cnao.gov.cn	www.audit.gov.cn	审计署 (National Audit Office)
china/economy/provincial/china-ah-stats.json	tj.ah.gov.cn	tjj.ah.gov.cn	安徽省统计局
china/economy/provincial/china-nm-stats.json	tjj.nmg.gov.cn	tj.nmg.gov.cn	内蒙古统计局
china/economy/provincial/china-yn-stats.json	tjj.yn.gov.cn	stats.yn.gov.cn	云南省统计局

Verification Method

• dns.google (境外): All 4 return NXDOMAIN
• dns.alidns.com (境内): All 4 return NXDOMAIN — confirmed dead from both perspectives
• New domains: All 4 resolve successfully via both DNS providers

Required Changes

For each source, update both website and data_url fields to the new domain. The data_url paths may also need verification (e.g., /tjsj/ path may differ on new domain).

Additional Finding

The same scan also identified 5 domains that return SERVFAIL from Google DNS but resolve normally from Alibaba DNS (境外 DNS 不可见). These are Chinese government domains blocked at DNS level for foreign resolvers — not bugs, but relevant for scan infrastructure design:

• www.tobacco.gov.cn, www.mca.gov.cn, www.mnr.gov.cn, www.mohurd.gov.cn, tjj.suzhou.gov.cn

Implication: Any DNS-layer health check must use China-based DNS (e.g., Alibaba DoH) for .gov.cn domains, not Google DNS alone.

Context

Discovered during QA URL Verification R8 (DNS layer health monitoring). Full scan: 541 unique domains, 10 DNS failures, 4 confirmed NXDOMAIN (this issue), 5 GFW/DNS-blocked (not bugs), 1 intermittent (recovered).

[mingcha-dev]

Additional Finding: DNS Instability for tobacco.gov.cn and mohurd.gov.cn

Cross-validation by @firstdata-dev and @mingcha-dev revealed that www.tobacco.gov.cn and www.mohurd.gov.cn have intermittent DNS resolution — results vary across providers and time:

www.tobacco.gov.cn (china-stma.json)

DNS Provider	Run 1 (mingcha)	Run 2 (firstdata)	Run 3 (mingcha)
AliDNS	✅ 219.142.71.16	❌ SERVFAIL	✅ 219.142.71.16
DNSPod	✅ 219.142.71.16	✅ 219.142.71.16	✅ 219.142.71.16
Google	❌ SERVFAIL	❌ SERVFAIL	❌ SERVFAIL

www.mohurd.gov.cn (china-mohurd.json)

DNS Provider	Run 1 (mingcha)	Run 2 (firstdata)	Run 3 (mingcha)
AliDNS	✅ CDN (bsclink.cn)	❌ SERVFAIL	✅ CDN (bsclink.cn)
DNSPod	✅ CDN (bsclink.cn)	❌ SERVFAIL	❌ SERVFAIL
Google	❌ SERVFAIL	❌ SERVFAIL	❌ SERVFAIL

Assessment

• Not simple GFW blocking (which would be consistently境外 fail / 境内 pass)
• DNS infrastructure is flaky — inconsistent across providers and time
• These are active government websites (烟草专卖局, 住建部), so the domains are not dead
• Source URLs use www.* prefix which resolves more reliably than base domain
• Recommendation: Add to DNS monitoring watchlist, do not mark as inactive

[mingcha-dev]

Update: mohurd.gov.cn confirmed as real DNS failure

After cross-validation by @firstdata-dev (three DNS sources all SERVFAIL for www.mohurd.gov.cn including AliDNS and DNSPod), mohurd is not a GFW false positive — it is a real DNS failure.

Reclassification:

• www.mohurd.gov.cn (china-mohurd.json): 3/3 DNS sources SERVFAIL → real DNS failure, needs investigation/URL update
• www.tobacco.gov.cn (china-stma.json): 1/3 sources can resolve (DNSPod only, intermittent) → unstable DNS, needs monitoring

Lesson learned:

Single-point DNS query cannot determine stability. DNS status characterization requires multi-timepoint sampling (at least 2-3 queries with intervals). Initial characterization of "all 5 SERVFAIL = normal in China / GFW" was incorrect for mohurd (all fail) and tobacco (intermittent).

[mingcha-dev]

Correction: mohurd reclassified to Tier 3 monitoring (not bug)

Per discussion with @mingjian: www.mohurd.gov.cn DNS is intermittently unstable (resolves sometimes, SERVFAIL other times within minutes). This is not a clear-cut "dead domain" — it is a flaky DNS infrastructure issue.

Updated disposition:

• mohurd: Do NOT add to whitelist. Place in Tier 3 persistent monitoring list. Accumulate failure count; escalate to warning/critical per existing Tier 3 severity rules (single-source 2x consecutive → ⚠️ warning, all-source 2x consecutive → 🔴 critical)
• tobacco: Same treatment — Tier 3 monitoring, no whitelist
• Previous comment classifying mohurd as "real DNS failure needing URL update" is superseded by this one