Hi List
Usually I have no problems identifying DNSSEC issues, but I don't get this one.
Our two main caching DNS Servers run bind 9.11.2-P1, after flushing the cache and even restarting still see an issue with this domain:
09-Apr-2018 09:28:25.934 no valid RRSIG resolving 'ns2.bncr.fi.cr/DS/IN': 201.220.29.22#53 09-Apr-2018 09:28:26.111 no valid RRSIG resolving 'ns2.bncr.fi.cr/DS/IN': 201.220.29.151#53 09-Apr-2018 09:28:26.111 no valid DS resolving 'ns2.bncr.fi.cr/AAAA/IN': 201.220.29.22#53 09-Apr-2018 09:28:26.111 no valid DS resolving 'ns2.bncr.fi.cr/A/IN': 201.220.29.22#53 09-Apr-2018 09:28:26.286 broken trust chain resolving 'ns2.bncr.fi.cr/A/IN': 201.220.29.151#53
https://en.internet.nl/site/www.bncr.fi.cr/199938/ => DNSSEC Valid http://dnsviz.net/d/www.bncr.fi.cr/dnssec/ => No issues
Doing the same test via a 9.10.3-P4-Debian with Validation enabled, works fine.
Retrieving any +dnssec with dig shows there is an RRSIG for those entries.
Does anyone have an idea what the cause of this issue could be?
Maybe an algo which Bind 9.10 understands (or does not and therefore skipps testing) but 9.11 not? The log of bind 9.10 looks like the validation did succeed thou...
Mit freundlichen Grüssen
-Benoît Panizzon-
On 09.04.18 09:59, Benoit Panizzon wrote:
Hi List
[...] Our two main caching DNS Servers run bind 9.11.2-P1, after flushing the cache and even restarting still see an issue with this domain: [...] Doing the same test via a 9.10.3-P4-Debian with Validation enabled, works fine.
The most likely reason: Bind 9.11 enables EDNS cookies by default, but the authoritative servers for this domain do not handle EDNS correctly:
https://ednscomp.isc.org/ednscomp/b01039e111
quick fix: server NSNAME { send-cookie no; };
Btw: Currently, many resolvers implement workarounds for such broken nameservers, but several open-source resolver implementations agreed on removing these workarounds next year, so the affected nameservers will have to be fixed.
https://blog.powerdns.com/2018/03/22/removing-edns-workarounds/
Hi Oli
The most likely reason: Bind 9.11 enables EDNS cookies by default, but the authoritative servers for this domain do not handle EDNS correctly:
https://ednscomp.isc.org/ednscomp/b01039e111
quick fix: server NSNAME { send-cookie no; };
That was the cause and the fix. Thanks a lot!
Mit freundlichen Grüssen
-Benoît Panizzon-
-
Benoit Panizzon -
Oli Schacher