<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Perhaps provide the ocsp.entrust.net folks 3rd party evaluation tool(s) to identify areas of concerns?</span></div><div><br><span></span></div><div><span>For example, here are two:<br></span></div><div><span>http://www.dnsvalidation.com/reports/4f96bdec7d79ee78db000044<br></span></div><div><span>http://www.intodns.com/ocsp.entrust.net</span></div><div>These find more than one critical item to fix.</div><div><br></div><div>Why is everyone else in the worldgetting NOERROR? In my experience, BIND is less forgiving for configuration related-issues than some of DNS peers out there.</div><div><br></div><div>Hope this helps.<br><span></span></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new
york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> "Bischof, Ralph F. (MSFC-IS40)[NICS]" <ralph.bischof@nasa.gov><br> <b><span style="font-weight: bold;">To:</span></b> "bind-users@lists.isc.org" <bind-users@lists.isc.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, April 24, 2012 10:06 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> SERVFAIL with ocsp.entrust.net.<br> </font> </div> <br>
Hello,<br><br> I have been trying to find out why my caching servers are giving SERVFAIL as an answer for any type of query except for an A record for the domain in the subject. Whether I try a AAAA, TXT, SOA, PTR, TXT, etc, I get a SERVFAIL answer. Yet, it seems that anyone else in the world is getting NOERROR. Now, when I direct the query to the Microsoft DNS servers (8.8.8.8), I also get NOERROR. I have tried different versions of clients (9.4.3-P5 and 9.6-ESV-R4-P3) and get the same response, so I do not think that is the issue.<br><br> When I use a 'dig +trace', the end of the chain shows a server that does not exist in the last answer consisting of the SOA record. In fact, since Sungard is involved, the whole chain makes no sense to me. I have edited out the extra stuff, but here is what I try to do.<br><br>First, here is the 'dig +trace' with an A query. I left out the list of the root and gtld servers.
<br>[bischrf@nsc1 ~]$ dig +trace <a target="_blank" href="http://ocsp.entrust.net">ocsp.entrust.net</a>. a<br>;; Received 300 bytes from 192.149.130.101#53(192.149.130.101) in 0 ms<br>;; Received 491 bytes from 192.5.5.241#53(<a target="_blank" href="http://f.root-servers.net">f.root-servers.net</a>) in 26 ms<br> <br>entrust.net. 172800 IN NS <a target="_blank" href="http://secondary-ns1.allstream.com">secondary-ns1.allstream.com</a>.<br>entrust.net. 172800 IN NS <a target="_blank" href="http://secondary-ns2.allstream.com">secondary-ns2.allstream.com</a>.<br>entrust.net. 172800 IN NS <a target="_blank" href="http://ns1.entrust.net">ns1.entrust.net</a>.<br>entrust.net.
172800 IN NS <a target="_blank" href="http://ns2.entrust.net">ns2.entrust.net</a>.<br>;; Received 203 bytes from 192.42.93.30#53(<a target="_blank" href="http://g.gtld-servers.net">g.gtld-servers.net</a>) in 115 ms<br> <br>ocsp.entrust.net. 7200 IN NS <a target="_blank" href="http://gns1.sungardns.com">gns1.sungardns.com</a>.<br>ocsp.entrust.net. 7200 IN NS <a target="_blank" href="http://gns2.sungardns.com">gns2.sungardns.com</a>.<br>;; Received 85 bytes from 216.13.122.23#53(secondary-ns1.allstream.com) in 120 ms<br> <br>ocsp.entrust.net. 30 IN A 216.191.247.139<br>;; Received 50 bytes from 207.19.96.22#53(gns1.sungardns.com) in 109
ms<br>------------------------<br>Then a 'dig +trace' looking for the AAAA record.<br>[bischrf@nsc1 ~]$ dig +trace ocsp.entrust.net. aaaa<br>;; Received 344 bytes from 192.149.130.101#53(192.149.130.101) in 0 ms<br>;; Received 491 bytes from 199.7.83.42#53(<a target="_blank" href="http://l.root-servers.net">l.root-servers.net</a>) in 160 ms<br> <br>entrust.net. 172800 IN NS secondary-ns1.allstream.com.<br>entrust.net. 172800 IN NS secondary-ns2.allstream.com.<br>entrust.net. 172800 IN NS ns1.entrust.net.<br>entrust.net. 172800 IN NS ns2.entrust.net.<br>;; Received 203 bytes from 192.26.92.30#53(<a
target="_blank" href="http://c.gtld-servers.net">c.gtld-servers.net</a>) in 34 ms<br> <br>ocsp.entrust.net. 7200 IN NS gns1.sungardns.com.<br>ocsp.entrust.net. 7200 IN NS gns2.sungardns.com.<br>;; Received 85 bytes from 216.191.247.202#53(ns2.entrust.net) in 125 ms<br> <br>entrust.net. 60 IN SOA <a target="_blank" href="http://phlig3.oamp.sgns.net">phlig3.oamp.sgns.net</a>. <a target="_blank" href="http://hostmaster.phlig3.oamp.sgns.net">hostmaster.phlig3.oamp.sgns.net</a>. 42 10800 3600 604800 60<br>;; Received 98 bytes from 207.19.96.22#53(gns1.sungardns.com) in 111 ms<br>NOTE: phlig3.oamp.sgns.net does not exist.<br>----------------------------------<br><br>Here is the query that works.<br>[bischrf@nsc1 ~]$ dig
ocsp.entrust.net. a<br><br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29329<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2<br> <br>;; ANSWER SECTION:<br>ocsp.entrust.net. 24 IN A 216.191.247.203<br> <br>;; AUTHORITY SECTION:<br>ocsp.entrust.net. 1675 IN NS gns1.sungardns.com.<br>ocsp.entrust.net. 1675 IN NS gns2.sungardns.com.<br>---------------------------<br><br>Now a AAAA query. Note there is no authority.<br>[bischrf@nsc1 ~]$ dig ocsp.entrust.net. aaaa<br><br>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20073<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br>--------------------------<br><br>So now I try to follow the chain. <br>1)
Query entrust.net. for the NS records. I get 4.<br>[bischrf@nsc1 ~]$ dig entrust.net. ns<br><br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17958<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4<br> <br>;; ANSWER SECTION:<br>entrust.net. 1617 IN NS ns2.entrust.net.<br>entrust.net. 1617 IN NS secondary-ns1.allstream.com.<br>entrust.net. 1617 IN NS ns1.entrust.net.<br>entrust.net. 1617 IN NS secondary-ns2.allstream.com.<br>---------------------<br><br>2) I pick one of those and ask for the NS records for ocsp.entrust.net.<br>[bischrf@nsc1 ~]$
dig @ns1.entrust.net. ocsp.entrust.net. ns<br> <br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7029<br>;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0<br>;; WARNING: recursion requested but not available<br> <br>;; AUTHORITY SECTION:<br>ocsp.entrust.net. 7200 IN NS gns1.sungardns.com.<br>ocsp.entrust.net. 7200 IN NS gns2.sungardns.com.<br>----------------------<br><br>3) I pick one of those and try a AAAA query.<br>[bischrf@nsc1 ~]$ dig @gns1.sungardns.com. ocsp.entrust.net. aaaa<br> <br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4292<br>;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0<br>;; WARNING: recursion requested but not available<br> <br>;; AUTHORITY SECTION:<br>entrust.net.
60 IN SOA phlig3.oamp.sgns.net. hostmaster.phlig3.oamp.sgns.net. 42 10800 3600 604800 60<br>------------------------------<br><br>Note above that I do get an authority, yet the MNAME does not exist. In fact, when I direct a query to the Microsoft DNS server for the record "phlig3.oamp.sgns.net", I get a SERVFAIL.<br>[bischrf@nsc1 ~]$ dig @8.8.8.8 phlig3.oamp.sgns.net.<br> <br>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 58650<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br> -------------------------------<br><br>So I try to find what is up with that record and I end up with a dead end at the NS records for oamp.sgns.net. I find the NS records, but I cannot get an IP for either one of them.<br>[bischrf@nsc1 ~]$ dig sgns.net. ns<br> <br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19454<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 2,
AUTHORITY: 0, ADDITIONAL: 0<br> <br>;; ANSWER SECTION:<br>sgns.net. 1779 IN NS ns2.sungardns.com.<br>sgns.net. 1779 IN NS ns1.sungardns.com.<br> -------------------------------------------<br> [bischrf@nsc1 ~]$ dig @ns2.sungardns.com. oamp.sgns.net. ns<br> <br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64087<br>;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0<br>;; WARNING: recursion requested but not available<br> <br>;; AUTHORITY SECTION:<br>oamp.sgns.net. 3600 IN NS phlnn1.oamp.sgns.net.<br>oamp.sgns.net. 3600 IN NS
hounn1.oamp.sgns.net.<br>------------------------------<br>[bischrf@nsc1 ~]$ dig @ns2.sungardns.com. phlnn1.oamp.sgns.net.<br> <br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25825<br>;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0<br>;; WARNING: recursion requested but not available<br> <br>;; AUTHORITY SECTION:<br>oamp.sgns.net. 3600 IN NS phlnn1.oamp.sgns.net.<br>oamp.sgns.net. 3600 IN NS hounn1.oamp.sgns.net.<br> -------------------------------------<br>[bischrf@nsc1 ~]$ dig @ns2.sungardns.com. hounn1.oamp.sgns.net. <br> <br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56868<br>;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0<br>;; WARNING: recursion requested but not available<br> <br>;; AUTHORITY
SECTION:<br>oamp.sgns.net. 3600 IN NS phlnn1.oamp.sgns.net.<br>oamp.sgns.net. 3600 IN NS hounn1.oamp.sgns.net.<br> ---------------------------<br><br> I did talk with both Sungard and Entrust on what I found and they sent me an email that they fixed "something" last night. How can I troubleshoot more why my servers are reporting SERVFAIL for any non-A types for this domain where it seems that everyone else in the world is getting NOERROR? Thank you for reading this far and any help that you can provide.<br><br><br>Thank you,<br>Ralph F. Bischof, Jr.<br>NASA Agency IPAM/DNS/DHCP<br>SAIC/NICS<br>256-544-3982<br><br><br>_______________________________________________<br>Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users"
target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br><br>bind-users mailing list<br><a ymailto="mailto:bind-users@lists.isc.org" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br><br><br> </div> </div> </blockquote></div> </div></body></html>