Hi Alessandro, On 10/21/21 17:21, Alessandro Dentella wrote: > recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: OPT answer '.' from > 'thux.lan' nameservers > recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for > dns1b.thux.lan, we likely missed a cut between . and dns1b.thux.lan, looking > for it > recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
The trace is not complete, but you might have to either set an NTA for .lan in your config[1] or set dnssec=off in you recursor.conf. Do the first if you care about DNSSEC validation or the second if you don't care about it. Cheers, Pieter 1 - https://doc.powerdns.com/recursor/dnssec.html#negative-trust-anchors -- Pieter Lexis PowerDNS.COM BV -- https://www.powerdns.com _______________________________________________ Pdns-users mailing list Pdns-users@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/pdns-users
