Hi,
we're experiencing the problem that pdns_recursor (4.3.5 and 4.5.1)
answers with the information from the . zone instead of what we have
configured in forward.zone.
Some configuration details (please name the setting you additionally
need to diagnose the problem further)
forward.zones:
...
+united.domain=172.19.254.20,172.19.254.21,172.19.254.22,172.19.254.23
... (it is a file with 344 lines)
nta.lua:
...
addNTA('united.domain')
addNTA('domain')
... (it is a file with 343 lines)
When freshly started or after `rec_control wipe-cache united.domain` the
answer is correct and like this:
$ dig united.domain
; <<>> DiG 9.16.20-RH <<>> united.domain
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11702
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;united.domain. IN A
;; ANSWER SECTION:
united.domain. 589 IN A 10.76.121.36
united.domain. 589 IN A 10.76.121.2
united.domain. 589 IN A 10.76.121.4
united.domain. 589 IN A 10.76.121.34
after a while (we don't know what it triggers), the answer starts to
look like this:
$ dig united.domain +dnssec +multiline
; <<>> DiG 9.11.35-RedHat-9.11.35-1.fc33 <<>> united.domain +dnssec
+multiline
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28509
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;united.domain. IN A
;; AUTHORITY SECTION:
. 80 IN SOA a.root-servers.net.
nstld.verisign-grs.com. (
2021091700 ; serial
1800 ; refresh (30 minutes)
900 ; retry (15 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
. 80 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY
dog. 80 IN NSEC domains. NS DS RRSIG NSEC
. 80 IN RRSIG SOA 8 0 86400 (
20210930050000 20210917040000 26838 .
a8KnzPW3Psg0y/ViDhIggp5Eh90QtN3EePUWsVwiu4fl
bLgBPP/4tI9xETkroVYwNweGpEZ+ikURMptxD/UKO9Jp
xMTA1OEVCY7ZCAHpRJdCrnJTKA/CZ2OB663Qn3fm5jmn
ulS6DEO/mpjbzOzuEABIejZ1TQoE4YKtsINAY+qWox4r
n8A1pGbpcUDI5FcuYwVhIMoRN0DLH7lLMCfnS4ax8NWc
aEZng4MYjH4uoXO0eKjiFm7q+F6DmmJHFClnWNoBygR2
rOjzcBygTIQNbAw8hRrhL7IeK9DO1wn1/ElWo9ku0etV
2dPI7309bIwcb/FfcO8JmMnSG+ua1pswnA== )
. 80 IN RRSIG NSEC 8 0 86400 (
20210930050000 20210917040000 26838 .
IDuGEztug9Rw+kfmn8p5BtCI0HNsJZErAw8WU9z2P7WZ
IE7HxhCGznO4mSXH+hSeCyHgK/zqBQF/yyFI+K3gHy0i
90YNEWVLzJIpGNes2nWfMWmlKa0zBgnECnY8FIXiAkcC
JOFvXjdBlnPo+9E/ArG5fmHx119k+GtnGv9rSovYA2l1
SXG7kR5ZobPUokssWKwYWYqq/zGILeDPrYYe3Fod/HvF
w846BsxEQ+iZEmNNezp6cj2SUj+sjH4/jtjHrXkWEbTx
H7yQ4y7qMOYQ0AU47xU3PcZ2F4wJSFhrdKxKLtDL1lq0
JR7whIaHEwKcSfWQqXy0d4uckrRIHvsU5Q== )
dog. 80 IN RRSIG NSEC 8 1 86400 (
20210930050000 20210917040000 26838 .
ErJ0k73SHWxxeoKJaEYPtrsb7tOGlufC2RVzMt5MzA6W
8k41/xa0rjXT3NYFdYg8pNQAqmKEuN7CET8j+TzUBgtW
CiOTNXl9T8cZWHuy4fcAnJyUYVuWzIvt4cXtIr0DS+vG
VpGnoRITsWcb1re7upzM5+vsqRudMwKjuFJ8gKic6m9f
QX0F4h56Mlfr5orOD+lVqNT7AZFpEZeW+ci+szLjTI/L
HY2UeXet/DZcPdBxEZbCzl4kdymiOzTl7QEK9JU611OG
O5cAC/DAJjDM8nejs9G/eR9dcp/du94kuXc3n1kf2OIn
D7eHEx2AATDCN02rcJeKwhkr20SNMp+aAw== )
Activating trace-regex for united.domain gives the following output in
case of the second answer.
pdns_recursor[2094]: 1 [808808419/2] question for 'united.domain|A' from
10.76.173.43:50102
pdns_recursor[2094]: united.domain: Wants DNSSEC processing, auth data
in query for A
pdns_recursor[2094]: united.domain: Looking for CNAME cache hit of
'united.domain|CNAME'
pdns_recursor[2094]: united.domain: Looking for DNAME cache hit of
'united.domain|DNAME' or its ancestors
pdns_recursor[2094]: united.domain: No CNAME or DNAME cache hit of
'united.domain' found
pdns_recursor[2094]: united.domain: Entire name 'united.domain is
negatively cached via '.' for another 119 seconds
pdns_recursor[2094]: united.domain: updating validation state with
negative cache content for united.domain to Insecure
We have checked that 172.19.254.20 172.19.254.21 172.19.254.22
172.19.254.23 are answering for united.domain and were/are available all
the time.
Cheers Thomas
_______________________________________________
Pdns-users mailing list
Pdns-users@mailman.powerdns.com
https://mailman.powerdns.com/mailman/listinfo/pdns-users
