biomejs.dev SSL error

[hanakslr]

I'm unable to access the biomejs.dev, consistent behavior for the last few months atleast. Located in US northeast.

Error

$ curl https://biomejs.dev
curl: (35) LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version

I have looked at related issues: #1816 and #2329 - however, the conclusion there was that it was an issue with the ISP, or a specific DNS server, and that's not what I am seeing.

Unlike #2329, changing DNS servers does not fix this. All DNS servers return the same broken IP:

# Google DNS
$ dig @8.8.8.8 biomejs.dev +short
18.204.152.241

# Cloudflare DNS
$ dig @1.1.1.1 biomejs.dev +short
18.204.152.241

If I check the record itself I see

dig biomejs.dev CNAME
...

;; AUTHORITY SECTION:
biomejs.dev.		1551	IN	SOA	dns1.p01.nsone.net. domains+netlify.netlify.com. 1701467254 43200 7200 1209600 3600

But even the nameserver referenced is returning the same IP address.

# Authoritative nameserver (NSOne)
$ dig @dns1.p09.nsone.net biomejs.dev +short
18.204.152.241

If I specifically point at Netlify IP it resolves successfully with no SSL errors, so there isn't an issue with the handshake or certificates themselves.

curl -I --resolve biomejs.dev:443:75.2.60.5 https://biomejs.dev
HTTP/2 200 

Fwiw it looks like I'm getting served up a heroku app:

curl -v http://biomejs.dev 2>&1 | grep -i heroku
  Via: 1.0 heroku-router

The site doesn't seem to be down for everyone, but I suspect nsone may be doing some geographic routing/load balancing and serving up an old endpoint to my region (US northeast) - let me know if there is additional diagnostic info I can provide!

[hanakslr]

Adding 75.2.60.5 biomejs.dev to etc/hosts to bypass the DNS lookup is my workaround in the meantime.

[dyc3]

Well... its working for me. I'm also on the US east coast, but not that far north (North Carolina).

When I run dig, i get:

$dig @8.8.8.8 biomejs.dev +short
18.208.88.157
98.84.224.111

where did you get 75.2.60.5 from?

Fwiw it looks like I'm getting served up a heroku app

We don't use heroku at all.

[dyc3]

It appears that 18.208.88.157 is invalid. Our DNS is managed by netlify, so I'm not sure why its serving up wrong info.

[hanakslr]

Yeah, I saw that netlify is used, and the 75.2.60.5 is their load balancer IP (google search, according to their docs) - if I use it directly to bypass a DNS lookup it all resolves. The IP addresses you have hit netlify edges for me, which makes sense. Not sure if there was a previous version that was managed by heroku and theres just something stale in the config that never got cleared out/switched over.

[siketyan]

Thank you for the thorough investigation. Interestingly, I get the different IP addresses from the Netlify DNS (I am located in Japan):

❯ dig @dns1.p09.nsone.net biomejs.dev +short
52.74.6.109
13.215.239.219

Both adresses can be resolved to the correct edges:

❯ curl -I --resolve biomejs.dev:443:13.215.239.219 https://biomejs.dev/
HTTP/2 200 
accept-ranges: bytes
age: 1
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; fwd=miss
content-type: text/html; charset=UTF-8
date: Mon, 05 Jan 2026 02:12:26 GMT
etag: "33b5fd4305ca06b94e461b2b69fded28-ssl"
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KE5YTNQE9HZ2DZAR4F9PWR9Z
content-length: 121486
 
❯ curl -I --resolve biomejs.dev:443:52.74.6.109 https://biomejs.dev/
HTTP/2 200 
accept-ranges: bytes
age: 12
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: text/html; charset=UTF-8
date: Mon, 05 Jan 2026 02:12:37 GMT
etag: "33b5fd4305ca06b94e461b2b69fded28-ssl"
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KE5YV0NMSN1HWW8NMS089NK3
content-length: 121486

[siketyan]

@hanakslr It's possible that your ISP or some firewall stuff is trying to rewrite DNS responses regardless of its server. Can you confirm if that is happening by using DoH (DNS over HTTPS) or DoT (DNS over TLS)? If possible, also trying it in another PC and/or network connection would be nice.

DoH:

dig @dns.google biomejs.dev. A +https +short

DoT:

dig @dns.google biomejs.dev. A +tls +short

[hanakslr]

When I use DoH I get 98.84.224.111, 18.208.88.157 - same IPs as @dyc3, which I think makes sense because it's effectively asking google to make the request on my behalf but they originate from google (somewhere else).

Same network, different device I get the same thing - but when I switch to cell data it works. Since querying the authoritative nameserver directly results in the bad IP address, the ISP would need to be intercepting and rewriting the response consistently for months just for biome, which seems unlikely?

I'm shooting in the dark here, but is it possible that the site used to be deployed with heroku and in the migration to netlify there was a NSOne routing rule that didn't get switched over? Beyond that I'm out of ideas! I'd chalk it up to a weird glitch if it hadn't been happening for months and there weren't a couple other people reporting issues. This workarond continues to work if others get stuck, but let me know if there is any other info I can provide from my end. Thanks for the speedy responses!