<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.6129" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi BIND Users</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I am currently trialing Bind v9.8.1 and have come
across a issue with 1 particular domain.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>For some reason when I query the below domain on
bind resolver-cache nothing gets returned.?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>dig @<server> sceggs.nsw.edu.au
ns</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The debug logs show </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>13-Sep-2011 10:11:27.272 query-errors: debug 1:
client 203.134.1.70#10309: view host_resolver_trusted: query failed (SERVFAIL)
for sceggs.nsw.edu.au/IN/NS at query.c:6195<BR>13-Sep-2011 10:11:27.272
query-errors: debug 2: fetch completed at resolver.c:3160 for
sceggs.nsw.edu.au/NS in 30.000122: timed out/success
[domain:sceggs.nsw.edu.au,referral:0,restart:7,qrysent:7,timeout:6,lame:0,neterr:0,badresp:0,adberr:0,findfail:0,valfail:0]<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>named.conf has the below settings for
dnssec</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> dnssec-enable yes;<BR>
dnssec-validation auto;<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>Even with the below and managed-keys still does not
work</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> dnssec-enable yes;<BR>
dnssec-validation yes;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The only way a result is given is to turn off
dnssec-validation then it works!</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>"dnssec-validation no;"</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Only then a result is given for the query. The
domain is in the AU space which is not</FONT></DIV>
<DIV><FONT face=Arial size=2>currently signed. So I don't know why this would
affect sec-validation and the queried domain?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>Also noticed its happening in 9.7.2-P3</FONT></DIV>
<DIV> </DIV></FONT></DIV>
<DIV><FONT face=Arial size=2>Any ideas why this is happening and how to fix it
without loosing dnssec-validation?</FONT></DIV>
<DIV><FONT face=Arial size=2>Does anyone else have the same issue with the
above scenario?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks</FONT></DIV>
<DIV><FONT face=Arial size=2>Neil</DIV>
<DIV> </DIV></FONT></BODY></HTML>