Hi List
Fancy another DNS issue hunt?
We have DNSSEC validation enabled on our BIND DNS Servers.
We started seeing:
no valid RRSIG resolving 'www.numberportability.ch/DS/IN': 2a01:8100:2901::1:183:202#53
no valid RRSIG resolving 'www.numberportability.ch/DS/IN': 2a01:8100:2901::1:183:201#53
no valid RRSIG resolving 'www.numberportability.ch/DS/IN': 81.88.58.219#53
no valid RRSIG resolving 'www.numberportability.ch/DS/IN': 195.110.124.196#53
broken trust chain resolving 'www.numberportability.ch/HTTPS/IN': 2a01:8100:2901::1:183:202#53
broken trust chain resolving 'www.numberportability.ch/AAAA/IN': 2a01:8100:2901::1:183:202#53
client @0x803541d60 X.X.X.X#27325 (www.numberportability.ch): query failed (broken trust chain) for www.numberportability.ch/IN/AAAA at query.c:7724
And of course the query fails, disrupting access some some quite
important API.
numberportability.ch. 900 IN SOA dns1.swizzonic.ch. hostmaster.swizzonic.ch. 2022121601 10800 3600 604800 86400
$ dig +dnssec RRSIG www.numberportability.ch @dns1.swizzonic.ch
; <<>> DiG 9.16.33-Debian <<>> +dnssec RRSIG www.numberportability.ch @dns1.swizzonic.ch
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 39132
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
So, from my point of view, the authoritative DNS server thinks, this is
a recursive query and refuses to answer with the RRSIG, breaking
validation of that record.
Do you get to the same conclusion? Can you resolve this host via any
other DNSSEC validating nameserver?
I had no success contacting any technical inclined staff willing to
look at the issue since the issue started on 16. December via
hostmaster(a)swizzonic.ch by phone or via support(a)register.it. So if
anyone from Swizzonic is reading here, it would be nice to get a direct
contact to further investigate that issue.
Mit freundlichen Grüssen
-Benoît Panizzon-
--
I m p r o W a r e A G - Leiter Commerce Kunden
______________________________________________________
Zurlindenstrasse 29 Tel +41 61 826 93 00
CH-4133 Pratteln Fax +41 61 826 93 01
Schweiz Web http://www.imp.ch
______________________________________________________
Does someone know a way to reach Swizzonic outside their working hours?
A Domain of us got deactivated in the evening outside their working hours, event though the bill is paid and wouldn't be due yet.
Said domain is used for our dns servers we use for customer...
Hello
Curious about the «best practice» you use for IPv6 gateways in server config / datacenter.
Votes for static gateway settings on servers? Or do you use IPv6 nd/ra? Or perhaps DHCPv6?
Regards, Urs
SBB AG
Cyber Security
Cyber Defense Center
Poststrasse 6, 3072 Ostermundigen
Mobil +41 79 433 21 67
urs.bf.mueller(a)sbb.ch<mailto:urs.bf.mueller@sbb.ch> / www.sbb.ch<http://www.sbb.ch>
Hi there,
We are seeing some DNS resolution issues for a specific domain through Sunrise's recursors specifically.
Does anyone perhaps have a contact at Sunrise that could be helpful with debugging this please?
Already tried normal contact methods listed in PeeringDB etc and have been ignored or told that they don't help non-customers.
Regards,
Filip
Hi all.
As some of you know, I work at a money laund... financial
company. Some time ago, the question arose, how to effectively
destroy data safely and securely in an easy way?
How does your company deal with hard disks (or any media) that
needs to be decommissioned? Do you just dd a few times over it?
Or rather let a professional company shred your media to little
bits?
CU, Venty
--
10 PRINT "BASIC programmers don't die."
20 PRINT "They just GOSUB without RETURN."
30 END
READY.
Hi List
Yes, I am already in contact with Metanet techs.
We have a very strange issue with two of their email servers.
Connecting to Port 25 starts fine. SYN, SYN-ACK but then we start
seeing re-transmits until the connections times out.
This first happened to one of their server, then to another one, the
the first server became reachable again at the beginning of this week,
the second one still causes the same problem.
The Problem also occurs the other way round. Metanet is unable to
establish tcp connection to port 25 on rrmx.imp.ch
Is anyone else seeing such an issue, either to metanet or towards our
rrmx.imp.ch?
Has anyone any clue what could cause such an issue?
I compared traces of tcp connections to both of the affected metanet
servers, to the working one and to the one causing re-transmits.
The two initial SYN and SYN-ACK look identical and then to one
destination the re-transmits start and to the other destination I get
the SMTP HELO banner.
PS: Yes, I did disable the firewall on our mail-plattform and re-test.
This does not seem to be the cause.
--
Mit freundlichen Grüssen
-Benoît Panizzon- @ HomeOffice und normal erreichbar
--
I m p r o W a r e A G - Leiter Commerce Kunden
______________________________________________________
Zurlindenstrasse 29 Tel +41 61 826 93 00
CH-4133 Pratteln Fax +41 61 826 93 01
Schweiz Web http://www.imp.ch
______________________________________________________
