SERVFAIL for one hostname

[Tiemen Ruiten]

Hello,

Since a few days ago, we're having issues with resolution of this hostname:

download.wisselkoersenvoorjeadministratie.nl

Our FreeIPA DNS servers return SERVFAIL for that particular hostname.
What's funny, after I do a (successful) lookup directly at one of the
configured forwarders, 1.1.1.1, resolution works, until the TTL expires.
Other hostnames work fine. How can I troubleshoot this?

FreeIPA versions:
ipa-server-4.6.5-11.el7.centos.4.x86_64
ipa-server-dns-4.6.5-11.el7.centos.4.noarch

[[e-mail]@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>>
download.wisselkoersenvoorjeadministratie.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48732
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;download.wisselkoersenvoorjeadministratie.nl. IN A

;; Query time: 40 msec
;; SERVER: 10.100.110.36#53(10.100.110.36)
;; WHEN: Tue Apr 21 11:58:51 CEST 2020
;; MSG SIZE  rcvd: 73

[[e-mail]@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl
@1.1.1.1

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>>
download.wisselkoersenvoorjeadministratie.nl @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58424
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;download.wisselkoersenvoorjeadministratie.nl. IN A

;; ANSWER SECTION:
download.wisselkoersenvoorjeadministratie.nl. 3600 IN A 185.87.187.229

;; Query time: 43 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Tue Apr 21 11:58:59 CEST 2020
;; MSG SIZE  rcvd: 133

[[e-mail]@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>>
download.wisselkoersenvoorjeadministratie.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57208
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;download.wisselkoersenvoorjeadministratie.nl. IN A

;; ANSWER SECTION:
download.wisselkoersenvoorjeadministratie.nl. 3600 IN A 185.87.187.229

;; Query time: 24 msec
;; SERVER: 10.100.110.36#53(10.100.110.36)
;; WHEN: Tue Apr 21 11:59:01 CEST 2020
;; MSG SIZE  rcvd: 89

[François Cami]

Hi,

On Tue, Apr 21, 2020 at 12:19 PM Tiemen Ruiten via FreeIPA-users
 wrote:
> Hello,
>
> Since a few days ago, we're having issues with resolution of this hostname:
>
> download.wisselkoersenvoorjeadministratie.nl
>
> Our FreeIPA DNS servers return SERVFAIL for that particular hostname. What's funny, after I do a (successful) lookup directly at one of the configured forwarders, 1.1.1.1, resolution works, until the TTL expires. Other hostnames work fine. How can I troubleshoot this?

Please have a look at the logs:
https://www.freeipa.org/page/Troubleshooting/DNS#Getting_logs
There should be some entry at the time you reproduce the issue.

François
> FreeIPA versions:
> ipa-server-4.6.5-11.el7.centos.4.x86_64
> ipa-server-dns-4.6.5-11.el7.centos.4.noarch
>
> [[e-mail]@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl
>
> ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> download.wisselkoersenvoorjeadministratie.nl
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48732
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;download.wisselkoersenvoorjeadministratie.nl. IN A
>
> ;; Query time: 40 msec
> ;; SERVER: 10.100.110.36#53(10.100.110.36)
> ;; WHEN: Tue Apr 21 11:58:51 CEST 2020
> ;; MSG SIZE  rcvd: 73
>
> [[e-mail]@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl @1.1.1.1
>
> ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> download.wisselkoersenvoorjeadministratie.nl @1.1.1.1
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58424
> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 1452
> ;; QUESTION SECTION:
> ;download.wisselkoersenvoorjeadministratie.nl. IN A
>
> ;; ANSWER SECTION:
> download.wisselkoersenvoorjeadministratie.nl. 3600 IN A 185.87.187.229
>
> ;; Query time: 43 msec
> ;; SERVER: 1.1.1.1#53(1.1.1.1)
> ;; WHEN: Tue Apr 21 11:58:59 CEST 2020
> ;; MSG SIZE  rcvd: 133
>
> [[e-mail]@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl
>
> ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> download.wisselkoersenvoorjeadministratie.nl
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57208
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;download.wisselkoersenvoorjeadministratie.nl. IN A
>
> ;; ANSWER SECTION:
> download.wisselkoersenvoorjeadministratie.nl. 3600 IN A 185.87.187.229
>
> ;; Query time: 24 msec
> ;; SERVER: 10.100.110.36#53(10.100.110.36)
> ;; WHEN: Tue Apr 21 11:59:01 CEST 2020
> ;; MSG SIZE  rcvd: 89
>
> --
> Tiemen Ruiten
> Infrastructure Engineer
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Tiemen Ruiten]

Hello,

On Tue, Apr 21, 2020 at 12:46 PM François Cami  wrote:
> Hi,
>
> On Tue, Apr 21, 2020 at 12:19 PM Tiemen Ruiten via FreeIPA-users
>  wrote:
> > Hello,
> >
> > Since a few days ago, we're having issues with resolution of this
>
> hostname:
> > download.wisselkoersenvoorjeadministratie.nl
> >
> > Our FreeIPA DNS servers return SERVFAIL for that particular hostname.
>
> What's funny, after I do a (successful) lookup directly at one of the
> configured forwarders, 1.1.1.1, resolution works, until the TTL expires.
> Other hostnames work fine. How can I troubleshoot this?
>
> Please have a look at the logs:
> https://www.freeipa.org/page/Troubleshooting/DNS#Getting_logs
> There should be some entry at the time you reproduce the issue.

No lines related to named in /var/log/messages.

I set debug logging with 'rndc trace' on the IPA nameserver that's being
queried and this shows up in named.run when I query the hostname:

21-Apr-2020 13:07:37.912 fetch:
download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:07:37.939 client @0x7fcee8031200 10.100.120.47#36751 (
download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL) for
download.wisselkoersenvoorjeadministratie.nl/IN/A at
../../../bin/named-pkcs11/query.c:8580

[Tiemen Ruiten]

On Tue, Apr 21, 2020 at 1:10 PM Tiemen Ruiten  wrote:
> Hello,
>
> On Tue, Apr 21, 2020 at 12:46 PM François Cami  wrote:
> > Hi,
> >
> > On Tue, Apr 21, 2020 at 12:19 PM Tiemen Ruiten via FreeIPA-users
> >  wrote:
> > > Hello,
> > >
> > > Since a few days ago, we're having issues with resolution of this
> >
> > hostname:
> > > download.wisselkoersenvoorjeadministratie.nl
> > >
> > > Our FreeIPA DNS servers return SERVFAIL for that particular hostname.
> >
> > What's funny, after I do a (successful) lookup directly at one of the
> > configured forwarders, 1.1.1.1, resolution works, until the TTL expires.
> > Other hostnames work fine. How can I troubleshoot this?
> >
> > Please have a look at the logs:
> > https://www.freeipa.org/page/Troubleshooting/DNS#Getting_logs
> > There should be some entry at the time you reproduce the issue.
>
> No lines related to named in /var/log/messages.
>
> I set debug logging with 'rndc trace' on the IPA nameserver that's being
> queried and this shows up in named.run when I query the hostname:
>
> 21-Apr-2020 13:07:37.912 fetch:
> download.wisselkoersenvoorjeadministratie.nl/A
> 21-Apr-2020 13:07:37.939 client @0x7fcee8031200 10.100.120.47#36751 (
> download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL)
> for download.wisselkoersenvoorjeadministratie.nl/IN/A at
> ../../../bin/named-pkcs11/query.c:8580

Added debug level 3, here's a failed lookup and a successful one (after
lookup @1.1.1.1):

[root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep
wisselkoersen
21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): query (cache) '
download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): replace
21-Apr-2020 13:16:21.398 fetch:
download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:16:21.421 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL) for
download.wisselkoersenvoorjeadministratie.nl/IN/A at
../../../bin/named-pkcs11/query.c:8580
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): error
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): send
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): sendto
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): senddone
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): next
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): endrequest
21-Apr-2020 13:16:21.422 fetch completed at
../../../lib/dns-pkcs11/resolver.c:3754 for
download.wisselkoersenvoorjeadministratie.nl/A in 0.023506:
SERVFAIL/success [domain:wisselkoersenvoorjeadministratie.nl
,referral:0,restart:2,qrysent:2,timeout:0,lame:0,quota:0,neterr:0,badresp:2,adberr:0,findfail:0,valfail:0]
^C

[root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep
wisselkoersen
21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): query (cache) '
download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): replace
21-Apr-2020 13:17:15.389 fetch:
download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
download.wisselkoersenvoorjeadministratie.nl/A): looking for relevant NSEC3
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 proves name does not
exist: 'download.wisselkoersenvoorjeadministratie.nl'
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 indicates secure
range
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): send
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): sendto
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): senddone
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): next
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): endrequest

[Tiemen Ruiten]

Hello,

On Tue, Apr 21, 2020 at 1:20 PM Tiemen Ruiten  wrote:
> On Tue, Apr 21, 2020 at 1:10 PM Tiemen Ruiten 
> wrote:
> > Hello,
> >
> > On Tue, Apr 21, 2020 at 12:46 PM François Cami  wrote:
> > > Hi,
> > >
> > > On Tue, Apr 21, 2020 at 12:19 PM Tiemen Ruiten via FreeIPA-users
> > >  wrote:
> > > > Hello,
> > > >
> > > > Since a few days ago, we're having issues with resolution of this
> > >
> > > hostname:
> > > > download.wisselkoersenvoorjeadministratie.nl
> > > >
> > > > Our FreeIPA DNS servers return SERVFAIL for that particular hostname.
> > >
> > > What's funny, after I do a (successful) lookup directly at one of the
> > > configured forwarders, 1.1.1.1, resolution works, until the TTL expires.
> > > Other hostnames work fine. How can I troubleshoot this?
> > >
> > > Please have a look at the logs:
> > > https://www.freeipa.org/page/Troubleshooting/DNS#Getting_logs
> > > There should be some entry at the time you reproduce the issue.
> >
> > No lines related to named in /var/log/messages.
> >
> > I set debug logging with 'rndc trace' on the IPA nameserver that's being
> > queried and this shows up in named.run when I query the hostname:
> >
> > 21-Apr-2020 13:07:37.912 fetch:
> > download.wisselkoersenvoorjeadministratie.nl/A
> > 21-Apr-2020 13:07:37.939 client @0x7fcee8031200 10.100.120.47#36751 (
> > download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL)
> > for download.wisselkoersenvoorjeadministratie.nl/IN/A at
> > ../../../bin/named-pkcs11/query.c:8580
>
> Added debug level 3, here's a failed lookup and a successful one (after
> lookup @1.1.1.1):
>
> [root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep
> wisselkoersen
> 21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): query (cache) '
> download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
> 21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): replace
> 21-Apr-2020 13:16:21.398 fetch:
> download.wisselkoersenvoorjeadministratie.nl/A
> 21-Apr-2020 13:16:21.421 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL)
> for download.wisselkoersenvoorjeadministratie.nl/IN/A at
> ../../../bin/named-pkcs11/query.c:8580
> 21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): error
> 21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): send
> 21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): sendto
> 21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): senddone
> 21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): next
> 21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
> download.wisselkoersenvoorjeadministratie.nl): endrequest
> 21-Apr-2020 13:16:21.422 fetch completed at
> ../../../lib/dns-pkcs11/resolver.c:3754 for
> download.wisselkoersenvoorjeadministratie.nl/A in 0.023506:
> SERVFAIL/success [domain:wisselkoersenvoorjeadministratie.nl
> ,referral:0,restart:2,qrysent:2,timeout:0,lame:0,quota:0,neterr:0,badresp:2,adberr:0,findfail:0,valfail:0]
> ^C
>
> [root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep
> wisselkoersen
> 21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): query (cache) '
> download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
> 21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): replace
> 21-Apr-2020 13:17:15.389 fetch:
> download.wisselkoersenvoorjeadministratie.nl/A
> 21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
> download.wisselkoersenvoorjeadministratie.nl/A): looking for relevant
> NSEC3
> 21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
> download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 proves name does
> not exist: 'download.wisselkoersenvoorjeadministratie.nl'
> 21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
> download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 indicates secure
> range
> 21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): send
> 21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): sendto
> 21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): senddone
> 21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): next
> 21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
> download.wisselkoersenvoorjeadministratie.nl): endrequest

Does anyone have an idea? There is at least one domain that is showing the
same behaviour that I found: www.regenboog-lelystad.nl.

[Petr Menšík]

Hi Tiemen,

it might help you to use dig and delv to debug dns related issues. SERVFAIL is quite often some issue in DNSSEC validation. To ensure validation is reponsible, try just:

dig +cd download.wisselkoersenvoorjeadministratie.nl

It it succeeds, validation is responsible. Quite good tool to discover what is wrong in that is delv. Use +vtrace to get details. If your server provides recursive service, try targetting it with @127.0.0.1.

delv +cd +vtrace @127.0.0.1 download.wisselkoersenvoorjeadministratie.nl

If it tells you fully validated, it is ok. Try removing +cd. When it still validates, bind should get the same results. Only cached records may produce different results.

Try flushing cache under that domain:

rndc flushtree wisselkoersenvoorjeadministratie.nl

In case owner of that domain fixed the signature, it might help. If this did not help and you are quite sure this is uninteded error, temporary validation exception could be set. Before you do it, you should be confident noone tried to push you wrong answer into your cache. Usually, it should be error on domain server's that its operator had not yet fixed.

rndc nta wisselkoersenvoorjeadministratie.nl

Note NTA is time limited for a reason. Correct is fixing it on authoritative servers and flushing just cached tree. Check man rndc for details.

named-pkcs11 trace logs would get you similar messages to delv. But I find delv easier to use if possible.

Validation of www.regenboog-lelystad.nl. failed few minutes ago to me, but seems to be fixed now.

Regards,
Petr

[Tiemen Ruiten]

Hello Petr,

Thank you for the pointers. Even without DNSSEC validation, the query
doesn't return the A-record. Delv also returns SERVFAIL. What I do see at
DNSViz
https://dnsviz.net/d/download.wisselkoersenvoorjeadministratie.nl/dnssec/,
is "NSEC3 proving non-existence of
download.wisselkoersenvoorjeadministratie". That doesn't look normal, if I
compare it with mijn.ing.nl (hostname of a major bank in NL) there is no
such output. I'll try to contact the domain administrators and get them to
fix it

I tried to set the NTA, but it also didn't make a difference. Is there any
other way I could semi-permanently (until the domain administrators fix it)
work around this error?

On Wed, Apr 29, 2020 at 11:52 AM Petr Menšík via FreeIPA-users <
[e-mail]> wrote:
> Hi Tiemen,
>
> it might help you to use dig and delv to debug dns related issues.
> SERVFAIL is quite often some issue in DNSSEC validation. To ensure
> validation is reponsible, try just:
> dig +cd download.wisselkoersenvoorjeadministratie.nl
>
> It it succeeds, validation is responsible. Quite good tool to discover
> what is wrong in that is delv. Use +vtrace to get details. If your server
> provides recursive service, try targetting it with @127.0.0.1.
> delv +cd +vtrace @127.0.0.1
>
> download.wisselkoersenvoorjeadministratie.nl
>
> If it tells you fully validated, it is ok. Try removing +cd. When it still
> validates, bind should get the same results. Only cached records may
> produce different results.
>
> Try flushing cache under that domain:
> rndc flushtree wisselkoersenvoorjeadministratie.nl
>
> In case owner of that domain fixed the signature, it might help. If this
> did not help and you are quite sure this is uninteded error, temporary
> validation exception could be set. Before you do it, you should be
> confident noone tried to push you wrong answer into your cache. Usually, it
> should be error on domain server's that its operator had not yet fixed.
> rndc nta wisselkoersenvoorjeadministratie.nl
>
> Note NTA is time limited for a reason. Correct is fixing it on
> authoritative servers and flushing just cached tree. Check man rndc for
> details.
>
> named-pkcs11 trace logs would get you similar messages to delv. But I find
> delv easier to use if possible.
>
> Validation of www.regenboog-lelystad.nl. failed few minutes ago to me,
> but seems to be fixed now.
>
> Regards,
> Petr
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Petr Menšík]

On 4/29/20 2:30 PM, Tiemen Ruiten wrote:
> Hello Petr,
>
> Thank you for the pointers. Even without DNSSEC validation, the query
> doesn't return the A-record. Delv also returns SERVFAIL. What I do see at
> DNSViz
> https://dnsviz.net/d/download.wisselkoersenvoorjeadministratie.nl/dnssec/,
> is "NSEC3 proving non-existence of
> download.wisselkoersenvoorjeadministratie". That doesn't look normal, if I
> compare it with mijn.ing.nl (hostname of a major bank in NL) there is no
> such output. I'll try to contact the domain administrators and get them to
> fix it
>
> I tried to set the NTA, but it also didn't make a difference. Is there any
> other way I could semi-permanently (until the domain administrators fix it)
> work around this error?

I don't know what the issue is. I am sorry, do not know how can I help.

I tried this command:
for NS in $(dig +short ns wisselkoersenvoorjeadministratie.nl); do dig
+dnssec +short download.wisselkoersenvoorjeadministratie.nl @$NS; done
185.87.187.229
A 8 2 3600 20200507000000 20200416000000 27409
wisselkoersenvoorjeadministratie.nl.
Kg7KcdhcilEWlDrSFNf87n0TYXK7Os8rKFcQOcOcR/5Sppn3Gp6H/63S
Htw62Qcy4lhkV+cM8xBZHFVhsLoXeOfaVAU7kcn9W0vNoB+lLC+V/qAm
JDPl/7a8n5mJMoiRRR2VcX4EFNYEyrsMWa0XFW7ukVmCqDCWnX8n/8kR Irk=
A 8 2 3600 20200507000000 20200416000000 27409
wisselkoersenvoorjeadministratie.nl.
Kg7KcdhcilEWlDrSFNf87n0TYXK7Os8rKFcQOcOcR/5Sppn3Gp6H/63S
Htw62Qcy4lhkV+cM8xBZHFVhsLoXeOfaVAU7kcn9W0vNoB+lLC+V/qAm
JDPl/7a8n5mJMoiRRR2VcX4EFNYEyrsMWa0XFW7ukVmCqDCWnX8n/8kR Irk=
185.87.187.229
185.87.187.229
A 8 2 3600 20200507000000 20200416000000 27409
wisselkoersenvoorjeadministratie.nl.
Kg7KcdhcilEWlDrSFNf87n0TYXK7Os8rKFcQOcOcR/5Sppn3Gp6H/63S
Htw62Qcy4lhkV+cM8xBZHFVhsLoXeOfaVAU7kcn9W0vNoB+lLC+V/qAm
JDPl/7a8n5mJMoiRRR2VcX4EFNYEyrsMWa0XFW7ukVmCqDCWnX8n/8kR Irk=

It looks ok on the first glance. I could not find anything similar to
dnsviz.net in responses. Would it be possible just some geolocation
nodes are broken and others work? delv works fine on that name to me. I
do not have IPv6 connectivity, if that changes anything.

I have never seen such diagram for a name on dnsviz. I think there is
definitely something wrong with their server, maybe not only wrong
signatures. It should be in your named-pkcs11 logs when rndc trace was
increased to 5 at least.

Checking what their servers responded would be most important. It seems
I see different result than dnsviz.net. Checking from different regions
might help, is possible.
> On Wed, Apr 29, 2020 at 11:52 AM Petr Menšík via FreeIPA-users <
> [e-mail]> wrote:
> > Hi Tiemen,
> >
> > it might help you to use dig and delv to debug dns related issues.
> > SERVFAIL is quite often some issue in DNSSEC validation. To ensure
> > validation is reponsible, try just:
> > dig +cd download.wisselkoersenvoorjeadministratie.nl
> >
> > It it succeeds, validation is responsible. Quite good tool to discover
> > what is wrong in that is delv. Use +vtrace to get details. If your server
> > provides recursive service, try targetting it with @127.0.0.1.
> > delv +cd +vtrace @127.0.0.1
> >
> > download.wisselkoersenvoorjeadministratie.nl
> >
> > If it tells you fully validated, it is ok. Try removing +cd. When it still
> > validates, bind should get the same results. Only cached records may
> > produce different results.
> >
> > Try flushing cache under that domain:
> > rndc flushtree wisselkoersenvoorjeadministratie.nl
> >
> > In case owner of that domain fixed the signature, it might help. If this
> > did not help and you are quite sure this is uninteded error, temporary
> > validation exception could be set. Before you do it, you should be
> > confident noone tried to push you wrong answer into your cache. Usually, it
> > should be error on domain server's that its operator had not yet fixed.
> > rndc nta wisselkoersenvoorjeadministratie.nl
> >
> > Note NTA is time limited for a reason. Correct is fixing it on
> > authoritative servers and flushing just cached tree. Check man rndc for
> > details.
> >
> > named-pkcs11 trace logs would get you similar messages to delv. But I find
> > delv easier to use if possible.
> >
> > Validation of www.regenboog-lelystad.nl. failed few minutes ago to me,
> > but seems to be fixed now.
> >
> > Regards,
> > Petr
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...