We're seeing visitors on Bell Canada residential internet (and at least one report on Cogeco) unable to reach our site at all, while it works fine for the same people on mobile data and other ISPs. Using Vercel's own debug tooling (the vercel-support domain lookup tool and the vercel-connect-debug script), we've confirmed this is a DNS Resolution Mismatch, not anything wrong with our DNS/SSL/app config.
Summary of findings:
- Authoritative DNS (Cloudflare) is correctly configured.
dig/nslookupfrom unaffected networks correctly resolves whatslocal.ca and www.whatslocal.ca to Vercel's IPs (216.150.1.1, 216.150.16.1, etc.), with valid TLS handshakes on all 8 addresses in the range. - On a Bell Canada connection, the same domain resolves to 18.204.152.241, an unrelated Amazon-hosted IP serving a Heroku app (
Server: nginx,Via: 1.0 heroku-router,X-Powered-By: Express). TLS to that IP resets/fails. - This wrong answer is returned even when explicitly querying 8.8.8.8 from the affected network, ruling out a stale local resolver cache. Something in Bell's network path is intercepting DNS queries and substituting this answer regardless of destination resolver.
- Separately, direct connection attempts to the real Vercel IPs (all 8 addresses in both /24s) from the same Bell connection all time out on port 443, while ICMP ping to those same IPs succeeds. So it isn't purely a DNS issue, TCP connections to Vercel's real edge are also being blocked.
- We tried proxying the domain through Cloudflare (orange-cloud) as a possible workaround. It did not help, the exact same bogus IP (18.204.152.241) was still returned afterward, which suggests the interception is matching on the hostname itself, not on which backend/IP the domain currently points to.
- Domain-level reputation checks (Google Safe Browsing, Cisco Talos, McAfee/Trellix TrustedSource) all show whatslocal.ca as clean/uncategorized, not blocklisted, so this doesn't look like a passive "new domain" reputation filter, it behaves like an active interception rule.
What we're hoping to learn from Vercel:
- Is there any known issue with Bell Canada (AS577) reaching Vercel's edge IP ranges (216.150.1.0/24, 216.150.16.0/24)?
- Has anyone else reported this pattern with Bell or Cogeco?
- Any recommended next step from Vercel's side (alternate IP range, escalation path, etc.)?
Clean run, from an unaffected ISP (Comwave):
+---------------------------------------+------- Fetching IP Addresses|| whatslocal.ca IP range: 216.150.1.1, 216.150.1.65, 216.150.1.129, 216.150.1.193, 216.150.16.1, 216.150.16.65, 216.150.16.129, 216.150.16.193+---------------------------------------
+---------------------------------------+------- STARTING|| Domain to test: whatslocal.ca| Timestamp (UTC): Thu 20 Aug 2026 02:01:41 UTC+---------------------------------------
+---------------------------------------+------- IP Information
{ "org": "AS15128 Comwave Telecom Inc.", "region": "Ontario", "country": "CA", "timezone": "America/Toronto"}+---------------------------------------
+---------------------------------------+------- Testing 216.150.1.1 (representative of all 8 addresses tested — same result on every one)Checking headers via 216.150.1.1* Connected to 216.150.1.1 (216.150.1.1) port 443* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256* Server certificate:* subject: CN=whatslocal.ca* issuer: C=US; O=Let's Encrypt; CN=YR1* SSL certificate verify ok.* using HTTP/2< HTTP/2 307< location: https://www.whatslocal.ca/< server: Vercel
Checking ping to 216.150.1.14 packets transmitted, 4 packets received, 0.0% packet lossround-trip min/avg/max/stddev = 23.815/31.486/36.466/4.672 ms+---------------------------------------
(All 8 addresses in the range — 216.150.1.1/.65/.129/.193 and 216.150.16.1/.65/.129/.193 — returned identical clean results: valid TLS handshake, valid cert, correct 307 redirect, 0% ping loss.)
+---------------------------------------+------- dig whatslocal.ca
;; ->>HEADER<<- opcode: QUERY, status: NOERROR;; ANSWER SECTION:whatslocal.ca. 300 IN A 216.150.16.1whatslocal.ca. 300 IN A 216.150.1.1;; SERVER: 192.168.0.1#53(192.168.0.1)+---------------------------------------
+---------------------------------------+------- dig whatslocal.ca via 8.8.8.8
;; ->>HEADER<<- opcode: QUERY, status: NOERROR;; ANSWER SECTION:whatslocal.ca. 300 IN A 216.150.1.1whatslocal.ca. 300 IN A 216.150.16.1;; SERVER: 8.8.8.8#53(8.8.8.8)+---------------------------------------
+---------------------------------------+------- dig whatslocal.ca +trace
;; Full trace confirms correct delegation:. NS (root servers)ca. NS d.ca-servers.ca, c.ca-servers.ca, any.ca-servers.ca, j.ca-servers.cawhatslocal.ca. NS joyce.ns.cloudflare.com, santino.ns.cloudflare.comwhatslocal.ca. A 216.150.1.1whatslocal.ca. A 216.150.16.1;; Received from joyce.ns.cloudflare.com (authoritative)+---------------------------------------
+---------------------------------------+------- Output of whatslocal.ca
* Host whatslocal.ca:443 was resolved.* IPv4: 216.150.1.1, 216.150.16.1* SSL connection using TLSv1.3* Server certificate verify ok.* using HTTP/2< HTTP/2 307< location: https://www.whatslocal.ca/< server: VercelRedirecting...+---------------------------------------
+---------------------------------------| Time elapsed: 27 seconds+------- FINISHED+---------------------------------------
Failing run, from Bell Canada (personal identifying info redacted, IP/DNS evidence intact):
+---------------------------------------+------- Fetching IP Addresses|| whatslocal.ca IP range: 216.150.1.1, 216.150.1.65, 216.150.1.129, 216.150.1.193, 216.150.16.1, 216.150.16.65, 216.150.16.129, 216.150.16.193+---------------------------------------
+---------------------------------------+------- STARTING|| Domain to test: whatslocal.ca| Timestamp (UTC): 08/20/2026 02:22:03| Timestamp (Local): 08/19/2026 22:22:03+---------------------------------------
+---------------------------------------+------- IP Information
{ "ip": "[REDACTED — Bell Canada residential IP]", "hostname": "[REDACTED — Bell DSL PPPoE hostname]", "city": "[REDACTED]", "region": "Ontario", "country": "CA", "loc": "[REDACTED]", "org": "AS577 Bell Canada", "postal": "[REDACTED]", "timezone": "America/Toronto", "readme": "https://ipinfo.io/missingauth"}
+---------------------------------------
+---------------------------------------+------- Testing 216.150.1.1Checking headers via 216.150.1.1* Trying 216.150.1.1:443...* schannel: disabled automatic use of client certificate* ALPN: curl offers http/1.1* Connection timed out after 3006 milliseconds* closing connection #0
Checking ping to 216.150.1.1
Pinging 216.150.1.1 with 32 bytes of data:Reply from 216.150.1.1: bytes=32 time=6ms TTL=247Reply from 216.150.1.1: bytes=32 time=5ms TTL=247Reply from 216.150.1.1: bytes=32 time=5ms TTL=247Reply from 216.150.1.1: bytes=32 time=6ms TTL=247
Ping statistics for 216.150.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 5ms, Maximum = 6ms, Average = 5ms+---------------------------------------
+---------------------------------------+------- Testing 216.150.1.65Checking headers via 216.150.1.65* Trying 216.150.1.65:443...* Connection timed out after 3012 milliseconds
Checking ping to 216.150.1.65Pinging 216.150.1.65 with 32 bytes of data:Reply from 216.150.1.65: bytes=32 time=5ms TTL=247Reply from 216.150.1.65: bytes=32 time=8ms TTL=247Reply from 216.150.1.65: bytes=32 time=5ms TTL=247Reply from 216.150.1.65: bytes=32 time=5ms TTL=247Ping statistics for 216.150.1.65: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- Testing 216.150.1.129Checking headers via 216.150.1.129* Trying 216.150.1.129:443...* Connection timed out after 3001 milliseconds
Checking ping to 216.150.1.129Pinging 216.150.1.129 with 32 bytes of data:Reply from 216.150.1.129: bytes=32 time=8ms TTL=247Reply from 216.150.1.129: bytes=32 time=5ms TTL=247Reply from 216.150.1.129: bytes=32 time=8ms TTL=247Reply from 216.150.1.129: bytes=32 time=6ms TTL=247Ping statistics for 216.150.1.129: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- Testing 216.150.1.193Checking headers via 216.150.1.193* Trying 216.150.1.193:443...* Connection timed out after 3006 milliseconds
Checking ping to 216.150.1.193Pinging 216.150.1.193 with 32 bytes of data:Reply from 216.150.1.193: bytes=32 time=18ms TTL=247Reply from 216.150.1.193: bytes=32 time=16ms TTL=247Reply from 216.150.1.193: bytes=32 time=5ms TTL=247Reply from 216.150.1.193: bytes=32 time=5ms TTL=247Ping statistics for 216.150.1.193: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- Testing 216.150.16.1Checking headers via 216.150.16.1* Trying 216.150.16.1:443...* Connection timed out after 3008 milliseconds
Checking ping to 216.150.16.1Pinging 216.150.16.1 with 32 bytes of data:Reply from 216.150.16.1: bytes=32 time=6ms TTL=247Reply from 216.150.16.1: bytes=32 time=5ms TTL=247Reply from 216.150.16.1: bytes=32 time=5ms TTL=247Reply from 216.150.16.1: bytes=32 time=9ms TTL=247Ping statistics for 216.150.16.1: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- Testing 216.150.16.65Checking headers via 216.150.16.65* Trying 216.150.16.65:443...* Connection timed out after 3008 milliseconds
Checking ping to 216.150.16.65Pinging 216.150.16.65 with 32 bytes of data:Reply from 216.150.16.65: bytes=32 time=6ms TTL=247Reply from 216.150.16.65: bytes=32 time=5ms TTL=247Reply from 216.150.16.65: bytes=32 time=106ms TTL=247Reply from 216.150.16.65: bytes=32 time=118ms TTL=247Ping statistics for 216.150.16.65: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- Testing 216.150.16.129Checking headers via 216.150.16.129* Trying 216.150.16.129:443...* Connection timed out after 3006 milliseconds
Checking ping to 216.150.16.129Pinging 216.150.16.129 with 32 bytes of data:Reply from 216.150.16.129: bytes=32 time=6ms TTL=247Reply from 216.150.16.129: bytes=32 time=5ms TTL=247Reply from 216.150.16.129: bytes=32 time=11ms TTL=247Reply from 216.150.16.129: bytes=32 time=4ms TTL=247Ping statistics for 216.150.16.129: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- Testing 216.150.16.193Checking headers via 216.150.16.193* Trying 216.150.16.193:443...* Connection timed out after 3011 milliseconds
Checking ping to 216.150.16.193Pinging 216.150.16.193 with 32 bytes of data:Reply from 216.150.16.193: bytes=32 time=5ms TTL=247Reply from 216.150.16.193: bytes=32 time=5ms TTL=247Reply from 216.150.16.193: bytes=32 time=7ms TTL=247Reply from 216.150.16.193: bytes=32 time=8ms TTL=247Ping statistics for 216.150.16.193: Sent = 4, Received = 4, Lost = 0 (0% loss)+---------------------------------------
+---------------------------------------+------- nslookup debug whatslocal.ca
[REDACTED — local router PTR lookup / home network reverse-DNS noise, not relevant]
------------Got answer: HEADER: opcode = QUERY, id = 4, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 2, authority records = 0, additional = 0
QUESTIONS: whatslocal.ca, type = A, class = IN ANSWERS: -> whatslocal.ca internet address = 18.204.152.241 ttl = 10 (10 secs) -> whatslocal.ca internet address = 18.204.152.241 ttl = 10 (10 secs)
------------------------Got answer: HEADER: opcode = QUERY, id = 5, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS: whatslocal.ca, type = AAAA, class = IN AUTHORITY RECORDS: -> whatslocal.ca ttl = 1800 (30 mins) primary name server = joyce.ns.cloudflare.com responsible mail addr = dns.cloudflare.com serial = 2412676428 refresh = 10000 (2 hours 46 mins 40 secs) retry = 2400 (40 mins) expire = 604800 (7 days) default TTL = 1800 (30 mins)
------------Name: whatslocal.caAddresses: 18.204.152.241 18.204.152.241
+---------------------------------------
+---------------------------------------+------- nslookup whatslocal.ca via 8.8.8.8
Server: dns.googleAddress: 8.8.8.8
Name: whatslocal.caAddresses: 18.204.152.241 18.204.152.241
+---------------------------------------
+---------------------------------------+------- Output of whatslocal.ca
* Host whatslocal.ca:443 was resolved.* IPv6: (none)* IPv4: 18.204.152.241, 18.204.152.241* Trying 18.204.152.241:443...* schannel: disabled automatic use of client certificate* ALPN: curl offers http/1.1* Recv failure: Connection was reset* schannel: failed to receive handshake, SSL/TLS connection failed* closing connection #0
+---------------------------------------
+---------------------------------------| Time elapsed: 69.4 seconds|+------- FINISHED+---------------------------------------
Appreciate any pointers.
