On Thu, Apr 19, 2012 at 5:59 AM, Chris Thompson <span dir="ltr"><<a href="mailto:cet1@cam.ac.uk">cet1@cam.ac.uk</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Apr 19 2012, Richard Laager wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Are others timing out trying to resolve <a href="http://www.glb.hud.gov" target="_blank">www.glb.hud.gov</a>? This seems<br>
(though I haven't done extensive testing) to only happen to me with<br>
BIND.<br>
<br>
<a href="http://dnsviz.net/d/www.glb.hud.gov/dnssec/" target="_blank">http://dnsviz.net/d/www.glb.<u></u>hud.gov/dnssec/</a> shows a couple of DNSKEY<br>
warnings, so maybe that's it. I always suspect DNSSEC when I have<br>
problems with .gov domains, but I commented out "dnssec-enable yes" in<br>
my named.conf and it didn't help.<br>
</blockquote>
<br></div>
There is no DS record in the parent zone, so the zone contents could<br>
not be validated anyway.<br>
<br></blockquote><div><br></div><div>Yes, but there's a difference between "could not be validated", meaning there is no chain of trust extending to <a href="http://glb.hud.gov">glb.hud.gov</a> (the <a href="http://hud.gov">hud.gov</a> zone securely proves that the trust does not extend to <a href="http://glb.hud.gov">glb.hud.gov</a>) and "could not be validated", meaning there should be a chain, but the necessary DNSKEYs and RRSIGs are not available to validate it. The first should yield an insecure (i.e., unauthenticated) response, the second SERVFAIL. BIND gets hung up on the fact that the DNSKEY RRset for <a href="http://glb.hud.gov">glb.hud.gov</a> cannot be retrieved to validate the RRSIGs covering <a href="http://glb.hud.gov">glb.hud.gov</a> names and returns SERVFAIL, even though technically it should simply return an insecure response. Note that unbound responds appropriately:</div>
<div><br></div><div><div>$ dig +dnssec @localhost <a href="http://www.glb.hud.gov">www.glb.hud.gov</a></div><div><br></div><div>; <<>> DiG 9.7.3 <<>> +dnssec @localhost <a href="http://www.glb.hud.gov">www.glb.hud.gov</a></div>
<div>; (2 servers found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61547</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1</div>
<div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags: do; udp: 4096</div><div>;; QUESTION SECTION:</div><div>;<a href="http://www.glb.hud.gov">www.glb.hud.gov</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</div>
<div><br></div><div>;; ANSWER SECTION:</div><div><a href="http://www.glb.hud.gov">www.glb.hud.gov</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>30<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>170.97.67.13</div>
<div><a href="http://www.glb.hud.gov">www.glb.hud.gov</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>30<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>RRSIG<span class="Apple-tab-span" style="white-space:pre"> </span>A 7 4 30 20120425192819 20120418192819 18872 <a href="http://glb.hud.gov">glb.hud.gov</a>. qeuaykqCRmDoJ/b7+MayUC4LB5GCoJ00931CS8w+Ta6tuT/qv3dGsR1i NVP5Xh5x/kJVyM6M3red1b2e4zrw930xe5gegPxGyWZqT8CVF7clouOJ nPr3D+JGre46lvsi62ibhCfS82gfuNLg+028D6EasnWiQgcG70ONI2yU a+w=</div>
<div><a href="http://www.glb.hud.gov">www.glb.hud.gov</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>30<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>RRSIG<span class="Apple-tab-span" style="white-space:pre"> </span>A 7 4 30 20120424171101 20120417171101 27647 <a href="http://glb.hud.gov">glb.hud.gov</a>. kVWQcOoRa2BPK+K4mMQQ+SsFKk2F6F2euVS2xrzlKyYMmOHytouRq6LK En8edmPbm5iYDGnW/Hc7jPLQgqpRYVxkdjKTvjYNf+yjqBK1aBblVZ4b Y/hDCcbfO5DsVEmJ/HuEg9vlQ65inWB2xpLul0FOXC7xLn7ch/h8A8Jv UfQ=</div>
<div><br></div><div>;; Query time: 85 msec</div><div>;; SERVER: ::1#53(::1)</div><div>;; WHEN: Thu Apr 19 07:34:06 2012</div><div>;; MSG SIZE rcvd: 402</div></div><div><br></div><div>Casey</div></div>