3 new servers couldn't download the key for '.' and there really wasn't any indication

[Mark Andrews]

So you didn’t the log message produced by this?

                dnssec_log(zone, ISC_LOG_WARNING,
                           "Unable to fetch DNSKEY set '%s': %s", namebuf,
                           isc_result_totext(eresult));

And if the forwarder is stripping RRSIGs.  Forwarders need to support DNSSEC.

                dnssec_log(zone, ISC_LOG_WARNING,
                           "No DNSKEY RRSIGs found for '%s': %s", namebuf,
                           isc_result_totext(eresult));

Things will likely fail if you link to the world is broken or is not allowing
DNS over both UDP and TCP or is filtering fragments (check both IPv4 and IPv6) or
is blocking ICMP or ICMPv6.

Mark	


> On 31 Oct 2024, at 00:36, Drew Weaver <drew.weaver at thenap.com> wrote:
> 
> Hello,
>  We recently replaced 3 BIND 9 servers with newer ones.
>  For whatever reason during the initial setup process the 3 servers all failed to download the dnssec key for ‘.’ And there was no indication whatsoever that this failed.
>  I would propose that if the server is configured as a caching nameserver that if it cannot download the key the service shouldn’t start at all or there should be some very forceful indication that it didn’t work.
>  Also does anyone know under what conditions that process fails?
>  I’d like to avoid this in the future.
>  Thanks,
> -Drew
>  -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
> 
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users


-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka at isc.org