[Freeipa-users] broken trust chain resolving using 8.8.8.8 as forwarder
Hi,
I have trouble resolving some addresses with my freeipa server . in the log there are lots
of "broken trust chain" lines. like:
validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS)
May 3 14:36:11 myserver named-pkcs11[30906]: validating gew4-spclient.spotify.com/CNAME:
bad cache hit (com/DS)
May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving
'gew4-spclient.spotify.com/A/IN': 8.8.8.8#53
May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving
'gew4-spclient.spotify.com/TYPE65/IN': 8.8.8.8#53
I setup a global forward to 8.8.8.8 and forward only setting in the web gui.
I tried to change the dnssec settings in /etc/named.conf : dnssec-enable no;
dnssec-validation no;
That did not help.
I run freeipa 4.6.8. Release: 5.el7.centos.12 on centos7.9
When I change forwarding to: forward disabled in the webgui, i get lots of "network
unreachable resolving" in the logs.
I then can resolve most addresses but not all
To me looks like dns is not resolving as expected, but have no clue in where to look for a
solution.
Any help appreciated.
Thanks,
Rob.