<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Thank you for your response.</p>
<p><br>
</p>
<p>Date is correct in all servers as well as RRSIG.</p>
<p></p>
<div>Mon Nov 7 08:56:03 AST 2016</div>
<div>Mon Nov 7 05:56:03 UTC 2016</div>
<br>
<p></p>
<p><br>
</p>
<p></p>
<div>; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.4 <<>> +cd +dnssec dnskey +multi</div>
<div>;; global options: +cmd</div>
<div>;; Got answer:</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2882</div>
<div>;; flags: qr rd ra ad cd; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 1</div>
<div><br>
</div>
<div>;; OPT PSEUDOSECTION:</div>
<div>; EDNS: version: 0, flags: do; udp: 4096</div>
<div>;; QUESTION SECTION:</div>
<div>;.<span class="x_Apple-tab-span" style="white-space:pre"> </span>IN NS</div>
<div><br>
</div>
<div>;; ANSWER SECTION:</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS e.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS l.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS f.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS c.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS d.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS j.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS g.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS i.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS h.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS a.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS b.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS m.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>475207 IN NS k.root-servers.net.</div>
<div>.<span class="x_Apple-tab-span" style="white-space:pre"> </span>518400 IN RRSIG<span class="x_Apple-tab-span" style="white-space:pre">
</span>NS 8 0 518400 (</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>20161120050000 20161107040000 39291 .</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>eKuJRWssJm+Qy4q+R+bKAIfSkxsDSl3y1S8ib/BC6i1c</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>Uxd36YM/lRLTOvqcjiZu18lsgSC7cpmiyNkQ4ibbqe5z</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>sgOXAdhXhmeqK8Bo3x3kP8VHWzbU6MOkN+O+LHOFXgx1</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>BUlo83LKqsJVMw/mYTLo0RguMGS5L7lLgDSbMUe0ow78</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>vg0MdIJo90AeEga084UIF9swAi3JZt5ds+82xkbhmmYT</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>RrsUknd763IUS04z8lEo60bAlMD3huGboa8Dtagd6lXC</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>NKXvCbQYQJu6hwMwxC5Kdmj0+cYn7PJJqye7XCSSipUo</div>
<div><span class="x_Apple-tab-span" style="white-space:pre"></span>Uxa1j/P+TTPmZSR4z6/YmNoM6ynmo2P4mw== )</div>
<div><br>
</div>
<div>;; Query time: 0 msec</div>
<div>;; SERVER: 127.0.0.1#53(127.0.0.1)</div>
<div>;; WHEN: Mon Nov 07 08:57:33 AST 2016</div>
<div>;; MSG SIZE rcvd: 525</div>
<br>
<p></p>
<p><br>
</p>
<p><br>
</p>
<p>as for the messages, i only got these messages during the period of 4 minutes from 10:00 PM to 10:04 PM.</p>
<p><br>
</p>
<div id="x_Signature"><br>
<div class="x_ecxmoz-signature">-- <br>
<br>
<font color="#3366ff"><font color="#000000">Respectfully<b><br>
</b><b>Mahdi A. Mahdi</b></font></font><font color="#3366ff"><br>
<br>
</font><font color="#3366ff"></font></div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Mark Andrews <marka@isc.org><br>
<b>Sent:</b> Monday, November 7, 2016 12:17:21 AM<br>
<b>To:</b> Mahdi Adnan<br>
<b>Cc:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: BIND dnssec issue</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText"><br>
First check your system clocks and make sure they are correct.<br>
<br>
'date -u' will show the time in UTC.<br>
<br>
Here in Australia we are 11 hours in front of UTC so<br>
where I run 'date; date -u' I get:<br>
<br>
Mon 7 Nov 2016 07:42:33 EST<br>
Sun 6 Nov 2016 20:42:33 UTC<br>
<br>
'dig +cd +dnssec' will let you see the RRSIG inception and expiration<br>
times. They are in UTC. Below the RRsig expires at 20161114235959<br>
and it was create at 20161031000000.<br>
<br>
;; BADCOOKIE, retrying.<br>
<br>
; <<>> DiG 9.11.0 <<>> +cd +dnssec dnskey . +multi<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43548<br>
;; flags: qr rd ra ad cd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags: do; udp: 4096<br>
; COOKIE: c393bcde3d692889e9f12574581f9746ca751f3f49a0a1aa (good)<br>
;; QUESTION SECTION:<br>
;. IN DNSKEY<br>
<br>
;; ANSWER SECTION:<br>
. 171135 IN DNSKEY 256 3 8 (<br>
AwEAAYbinauHA9oUb4aGNtJIrepyGoYy0OL01rvIhvo3<br>
RWN/Ch8p2C4ZEkpvUYkx74r9JpgrOsjKOv+JQdKtT2u8<br>
AxGjUoH8x8HdpDiMV7XnpWJo9wAxlFtDtbMnPwRQ3dWs<br>
T1p5myrGcm7EFJ9j7KmiAEG5hGsevZqcnqMOW9QFkmp/<br>
zM0TFYXYWq6AsAof2uZqLUyd+nHIW0TGsaHMzcTNfA8W<br>
w+OYV7R4bcR/8edCEo6OAh9j48R1hRtuO1e2MQdnkITc<br>
9DJljB4Cq1gQKwv/ku7mAvmFuWkRotMZIFN3vDhpmpmy<br>
7M0C1EHSRAgP+HkblLRQKOPnwI/VksJEU4fmnhk=<br>
) ; ZSK; alg = RSASHA256 ; key id = 39291<br>
. 171135 IN DNSKEY 257 3 8 (<br>
AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQ<br>
bSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh<br>
/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWA<br>
JQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXp<br>
oY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3<br>
LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGO<br>
Yl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGc<br>
LmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=<br>
) ; KSK; alg = RSASHA256 ; key id = 19036<br>
. 171135 IN RRSIG DNSKEY 8 0 172800 (<br>
20161114235959 20161031000000 19036 .<br>
LPuldf5oWFdSHSTPYL5WvrvwJTElxY6LTEw2Cit0JOcV<br>
AbZG6LLCmlpCJ55Ngf/sdE4UXUPJ/m6CFRYT+aAePvEW<br>
rjRPGGX64V82oCeCPyAqD4XHd3CIQi3LBYk8ZbEktyvB<br>
X+VS16rbSEQib7xNYvohtiJ0dRiw/wjr6YVF8xUdYO1v<br>
vXPYOGXISYwW4vDiKAuyLDGuoLRh/F9GZQxBPwv6Bmx8<br>
/JfNCfIygbnZ/8qIZUsFH68DPbAHPBqwR1GP+haAa6vQ<br>
PhXwn4p+Vci7rYNzfPzdQfDNWsQ+8ur8xxSdanAZcZRr<br>
ytaidLtIQx4DeGANdwmNjnAn8ZSg6q8etQ== )<br>
<br>
;; Query time: 0 msec<br>
;; SERVER: 127.0.0.1#53(127.0.0.1)<br>
;; WHEN: Mon Nov 07 07:49:10 EST 2016<br>
;; MSG SIZE rcvd: 892<br>
<br>
As for "got insecure response; parent indicates it should be secure",<br>
there are still systems out there that do not response to EDNS<br>
queries or only respond to the first EDNS query. To get answers<br>
from these systems, especially after a lost packet, named has to<br>
ask plain DNS questions and as plain DNS does not have EDNS there<br>
is no DO=1 flag one does not DNSSEC records in the responses to<br>
those queries. When such answers go through the validator and the<br>
zone is signed you will this message logged.<br>
<br>
Old Microsoft Windows DNS servers exhibit this only answer the first<br>
EDNS query issue. You need to as a plain DNS query to get a response<br>
after the first EDNS query. When we do EDNS compliance testing we<br>
can see these systems as they end up being formerr and timeouts<br>
except for plain DNS.<br>
<br>
bihasitka-nsn.gov. @64.37.122.49 (ns2.chicagowebs.com.): dns=ok<br>
edns=formerr,nosoa edns1=formerr,badversion edns@512=timeout<br>
ednsopt=timeout edns1opt=timeout do=timeout ednsflags=timeout<br>
optlist=timeout signed=timeout ednstcp=formerr<br>
<br>
hamiltontn.gov. @12.204.222.241 (ns1.hamiltontn.gov.): dns=ok<br>
edns=timeout edns1=timeout edns@512=timeout ednsopt=formerr,echoed,nosoa<br>
edns1opt=timeout do=timeout ednsflags=timeout optlist=timeout<br>
signed=timeout ednstcp=timeout<br>
<br>
If you have lots of these messages check that you firewall allows<br>
through large (> 1500 byte) EDNS responses. Packet loss and bad<br>
local firewalls can make named think that it is talking to such a<br>
system. Excessive buffer bloat can also cause named to think it<br>
is talking to such a system. A big upload / download can make<br>
visible the buffer bloat in the routers on you link.<br>
<br>
Mark<br>
<br>
In message <BL2PR01MB3393C454FDCE60904E2781CFFA40@BL2PR01MB339.prod.exchangelabs.com>, Mahdi Adnan writes:<br>
> Hello,<br>
><br>
><br>
> We have several Bind recursive servers and all of them stop responding to<br>
> queries at 10:00 PM daily for 4 minutes starting from November 1st with<br>
> the following error in the logs;<br>
><br>
><br>
> "SOA: got insecure response; parent indicates it should be secure"<br>
><br>
> "DNSKEY: verify failed due to bad signature (keyid=56467): RRSIG has<br>
> expired"<br>
><br>
> "dlv.isc.org SOA: got insecure response; parent indicates it should be<br>
> secure"<br>
><br>
><br>
><br>
> servers running different versions of BIND (9.9 and 910) but all are up<br>
> to date.<br>
><br>
> anyone have any idea about this issue ?<br>
><br>
><br>
> Thanks<br>
> --<br>
><br>
> Respectfully<br>
> Mahdi A. Mahdi<br>
<br>
-- <br>
Mark Andrews, ISC<br>
1 Seymour St., Dundas Valley, NSW 2117, Australia<br>
PHONE: +61 2 9871 4742 INTERNET: marka@isc.org<br>
</div>
</span></font>
</body>
</html>