Hi, I have trouble resolving some addresses with my freeipa server . in the log there are lots of "broken trust chain" lines. like:
validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/A/IN': 8.8.8.8#53 May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/TYPE65/IN': 8.8.8.8#53
I setup a global forward to 8.8.8.8 and forward only setting in the web gui.
I tried to change the dnssec settings in /etc/named.conf : dnssec-enable no; dnssec-validation no; That did not help.
I run freeipa 4.6.8. Release: 5.el7.centos.12 on centos7.9
When I change forwarding to: forward disabled in the webgui, i get lots of "network unreachable resolving" in the logs. I then can resolve most addresses but not all
To me looks like dns is not resolving as expected, but have no clue in where to look for a solution.
Any help appreciated.
Thanks,
Rob.