Re: 9.11 can't validate sss.gov

2018-01-22 Thread Grant Taylor via bind-users
On 01/22/2018 09:21 AM, Warren Kumari wrote: http://www.sss.gov works OK, but http://sss.gov always seems to return "The requested service is temporarily unavailable. It is either overloaded or under maintenance. Please try later.". Inconsistency between related things is annoying. I guess pr

Re: 9.11 can't validate sss.gov

2018-01-22 Thread Warren Kumari
Unrelated to the DNS bit, but still silly / annoying: http://www.sss.gov works OK, but http://sss.gov always seems to return "The requested service is temporarily unavailable. It is either overloaded or under maintenance. Please try later.". There is a fair bit os disagreement over if a bare doma

Re: 9.11 can't validate sss.gov

2018-01-22 Thread Timothy A. Holtzen
I've informed the selective service (sss.gov) of the issue.  They have supposedly passed it on to their "web support group".  We will see if anything happens but I'm not holding my breath.  At least a government agency should have more influence to get qwest to fix their servers than I do. Timothy

Re: 9.11 can't validate sss.gov

2018-01-19 Thread Mark Andrews
Yes, qwest were informed years ago that there severs are broken. Report this to the .gov site operators. The servers return BADVERS to the queries which was never part of the EDNS spec and is a invention of the servers developers. FORMERR was permissible by STD13 but this was tightened when th

Re: 9.11 can't validate sss.gov

2018-01-19 Thread Tony Finch
Timothy A. Holtzen wrote: > I've run into an odd problem.  On the same host with nearly identical > configurations.  Bind 9.10.6 can resolve and DNSSEC validate sss.gov but > Bind 9.11.2 cannot. Ah, this is because sss.gov is hosted on Qwest's DNS servers that have broken EDNS logic which is inc

9.11 can't validate sss.gov

2018-01-19 Thread Timothy A. Holtzen
I've run into an odd problem.  On the same host with nearly identical configurations.  Bind 9.10.6 can resolve and DNSSEC validate sss.gov but Bind 9.11.2 cannot.  If I turn off DNSSEC validation 9.11.2 resolves it just fine.  According to http://dnsviz.net/d/sss.gov/dnssec/ it looks like the the d