openssl s_client -connect www.marsmedia.cc:443 from my home network connects to 64.29.17.1, which returns "wrong version number" — it's not sending valid TLS at all. A different WiFi network works fine, so it's routing me to a different, healthy node there.
Also ruled out: CAA records, leftover _acme-challenge records, stray AAAA records — all clean.
Can someone check if 64.29.17.1 is a legit edge node for this domain and why it's failing TLS?
The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.
I wasn't able to replicate the issue you're seeing with that IP. Maybe specific to your ISP or location?
There's a connectivity debugging guid with some steps that can give us more clues about what's going wrong. Can you try this and let me know what you find?
https://vercel.com/kb/guide/troubleshooting-connectivity-issues
Since DNS resolution is correct and consistent, the failure must be happening at the TCP/TLS connection itself, not name resolution. This matches what I found earlier with a direct openssl test: the connection reaches an IP in this range but the TLS handshake fails with "wrong version number" — meaning something is corrupting the handshake between my network and your edge, not a DNS problem. Can your team check TLS behavior specifically for 64.29.17.0/24 and 216.198.79.0/24 from an external vantage point?
