The Site Opens Overseas and Fails on Malaysian Networks

"It works on my phone" is not one test

A director abroad opens the homepage on hotel Wi-Fi and says the site is fine. The office in Shah Alam refreshes and gets a timeout, a certificate warning, or a blank Cloudflare page. Both observations are true. They are tests of different networks. A monitoring service in Singapore or the United States will agree with the director and will not see the office at all.

Before anyone rebuilds the site, split the failure. Note the time, the ISP, whether it is office Wi-Fi or mobile data, the exact error text, and a screenshot. "Down in Malaysia" without those four facts sends the technician to the wrong machine.

Office Wi-Fi versus mobile data

Turn Wi-Fi off and load the same URL on mobile data. If mobile data works and the office does not, the server is reachable from at least one Malaysian network. Look at the office router, the ISP resolver, and any filter the building added. If both fail, and a friend on a different ISP also fails, look at DNS for the domain and at anything that might treat Malaysian addresses differently.

Do not power-cycle the server as the first move. You will destroy the evidence of a firewall rule that only matches one country.

The resolver, not the server

Browsers ask a resolver for the address of the domain. The office router often asks the ISP's resolver. A stale or blocked answer there will not match what 1.1.1.1 or 8.8.8.8 returns. Compare them. If the public resolvers return an address and the ISP resolver returns nothing or an old address, the website is not down. The lookup is.

You can ask the browser to use a public resolver for one test without changing the whole office. If that single change makes the site appear, write down which resolver failed. The fix is then DNS, or a call to the ISP, not a new theme.

A rule aimed at Malaysia

Cloudflare and other proxies can be told to challenge or block visitors by country. Someone — an old security plugin, a past incident, a copied ruleset — may have left a rule that treats Malaysia as the threat. Visitors overseas never hit it. A trace URL on the affected network (the Cloudflare trace at /cdn-cgi/trace on a proxied site shows the country the edge thinks you are in) tells you whether you are being classified as MY and then challenged.

Read the firewall rules before you delete them. One of them may be blocking a real attack and also your customers. The edit is to stop blocking the country, not to turn the firewall off.

IPv6 that only fails on some networks

If the domain publishes an IPv6 address (an AAAA record) and that address does not actually reach the server, networks that prefer IPv6 will fail and networks that only use IPv4 will work. Mobile networks and office fibre do not prefer the same family. A site can look "international" simply because the tester's hotel had no IPv6.

Check whether an AAAA record exists and whether a connection to it succeeds from the network that fails. Removing a broken AAAA record is a one-line DNS change. Leaving it up and rebuilding the homepage will not help.

What to hand a technician

Send the four facts from the first section, plus the result of the mobile-data test and the result of a public-resolver test. Say whether /cdn-cgi/trace shows Malaysia. Say whether an AAAA record exists. That package is enough to tell a DNS fault from a country rule from a dead IPv6 address.

JagaWeb's Essential System Review (RM1,500) can take that package and the live DNS and say which of those three you are in. It will not conjure a route through an ISP outage, and it will not override a firewall you still want. If the records are already correct and you want them watched so the next panel edit does not put a bad AAAA back, that watch sits with JagaWeb Care (RM450/month). The inspection is the ownership review.