<div dir="ltr">It's messy to be sure but it's not failing validation on any of the systems I'm testing on (no AD bit because the CNAMEs aren't signed but no SERVFAIL either)(. I see a bunch of dig versions in your posting (9.3?). What version BIND is the server running? </div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 31, 2018 at 5:51 PM, Warren Kumari <span dir="ltr"><<a href="mailto:warren@kumari.net" target="_blank">warren@kumari.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Try it with +cd and see if that fixes it.<br>
<br>
The DNSSEC stuff for this domain is all borked up -- sufficiently that<br>
I felt like I was playing snakes and ladders while looking at:<br>
<a href="http://dnsviz.net/d/extranet.aro.army.mil/dnssec/" rel="noreferrer" target="_blank">http://dnsviz.net/d/extranet.<wbr>aro.army.mil/dnssec/</a><br>
<div class="HOEnZb"><div class="h5">On Thu, May 31, 2018 at 5:45 PM John Miller <<a href="mailto:johnmill@brandeis.edu">johnmill@brandeis.edu</a>> wrote:<br>
><br>
> Hi Con,<br>
><br>
> May I suggest running dig +trace <a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a> from your<br>
> nameserver? That'll make the delegation process explicit and help you<br>
> troubleshoot a little better. It could be that one of the three main<br>
> <a href="http://army.mil" rel="noreferrer" target="_blank">army.mil</a> nameservers is unreachable by your ns for some reason<br>
> (routing being a likely culprit).<br>
><br>
> John<br>
><br>
> On Thu, May 31, 2018 at 5:29 PM, Con Wieland <<a href="mailto:cwieland@uci.edu">cwieland@uci.edu</a>> wrote:<br>
> > and here they are but I don’t see anything indicating what the problem might be<br>
> ><br>
> > 31-May-2018 13:56:01.150 queries: info: client 128.200.1.20#37203 (<a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a>): view internal: query: <a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a> IN A +E (128.200.1.201)<br>
> > 31-May-2018 13:56:01.151 resolver: debug 1: createfetch: <a href="http://aro.army.mil.edgekey.dmz.akamai.csd.disa.mil" rel="noreferrer" target="_blank">aro.army.mil.edgekey.dmz.<wbr>akamai.csd.disa.mil</a> A<br>
> > 31-May-2018 13:56:06.153 queries: info: client 128.200.1.20#37203 (<a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a>): view internal: query: <a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a> IN A +E (128.200.1.201)<br>
> > 31-May-2018 13:56:06.153 resolver: debug 1: createfetch: <a href="http://aro.army.mil.edgekey.dmz.akamai.csd.disa.mil" rel="noreferrer" target="_blank">aro.army.mil.edgekey.dmz.<wbr>akamai.csd.disa.mil</a> A<br>
> > 31-May-2018 13:56:11.158 queries: info: client 128.200.1.20#37203 (<a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a>): view internal: query: <a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a> IN A +E (128.200.1.201)<br>
> > 31-May-2018 13:56:11.158 query-errors: debug 1: client 128.200.1.20#37203 (<a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a>): view internal: query failed (SERVFAIL) for <a href="http://extranet.aro.army.mil/IN/A" rel="noreferrer" target="_blank">extranet.aro.army.mil/IN/A</a> at query.c:7215<br>
> > 31-May-2018 13:56:11.158 resolver: debug 1: createfetch: <a href="http://aro.army.mil.edgekey.dmz.akamai.csd.disa.mil" rel="noreferrer" target="_blank">aro.army.mil.edgekey.dmz.<wbr>akamai.csd.disa.mil</a> A<br>
> > 31-May-2018 13:56:21.168 query-errors: debug 1: client 128.200.1.20#37203 (<a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a>): view internal: query failed (SERVFAIL) for <a href="http://extranet.aro.army.mil/IN/A" rel="noreferrer" target="_blank">extranet.aro.army.mil/IN/A</a> at query.c:7215<br>
> ><br>
> >> On May 31, 2018, at 12:51 PM, Reindl Harald <<a href="mailto:h.reindl@thelounge.net">h.reindl@thelounge.net</a>> wrote:<br>
> >><br>
> >><br>
> >><br>
> >> Am 31.05.2018 um 21:42 schrieb Con Wieland:<br>
> >>> agreed but why would my server not resolve it while others do?<br>
> >><br>
> >> ask the logs of 128.200.1.201<br>
> >><br>
> >> ; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> <a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a><br>
> >> ;; global options: +cmd<br>
> >> ;; Got answer:<br>
> >> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 56491<br>
> >> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<br>
> >> ;; SERVER: 128.200.1.201#53(128.200.1.<wbr>201)<br>
> >><br>
> >>>> On May 31, 2018, at 12:16 PM, Reindl Harald <<a href="mailto:h.reindl@thelounge.net">h.reindl@thelounge.net</a>> wrote:<br>
> >>>><br>
> >>>><br>
> >>>><br>
> >>>> Am 31.05.2018 um 21:09 schrieb Con Wieland:<br>
> >>>>> I have a nameserver that can not resolve <a href="http://extranet.aro.army.mil" rel="noreferrer" target="_blank">extranet.aro.army.mil</a>.<br>
> >>>><br>
> >>>> terrible slow and insane config - fix it<br>
> >>>><br>
> >>>> <a href="https://intodns.com/aro.army.mil" rel="noreferrer" target="_blank">https://intodns.com/aro.army.<wbr>mil</a><br>
> >>>><br>
> >>>> ;; Query time: 1175 msec<br>
> >>>> ;; SERVER: 127.0.0.1#53(127.0.0.1)<br>
> >>>> ;; WHEN: Do Mai 31 21:12:26 CEST 2018<br>
> >>>> ;; MSG SIZE rcvd: 247<br>
> >>>><br>
> >>>> ;; Query time: 1109 msec<br>
> >>>> ;; SERVER: 8.8.8.8#53(8.8.8.8)<br>
> >>>> ;; WHEN: Do Mai 31 21:12:52 CEST 2018<br>
> >>>> ;; MSG SIZE rcvd: 191<br>
> >>>><br>
> >>>> ;; ANSWER SECTION:<br>
> >>>> <a href="http://aro.army.mil" rel="noreferrer" target="_blank">aro.army.mil</a>. 2022 IN NS <a href="http://ns03.army.mil" rel="noreferrer" target="_blank">ns03.army.mil</a>.<br>
> >>>> <a href="http://aro.army.mil" rel="noreferrer" target="_blank">aro.army.mil</a>. 2022 IN NS <a href="http://ns02.army.mil" rel="noreferrer" target="_blank">ns02.army.mil</a>.<br>
> >>>> <a href="http://aro.army.mil" rel="noreferrer" target="_blank">aro.army.mil</a>. 2022 IN NS <a href="http://ns01.army.mil" rel="noreferrer" target="_blank">ns01.army.mil</a>.<br>
> >>>><br>
> >>>> ;; Query time: 163 msec<br>
> >>>> ;; SERVER: 192.82.113.7#53(192.82.113.7)<br>
> >>>> ;; WHEN: Do Mai 31 21:15:37 CEST 2018<br>
> >>>> ;; MSG SIZE rcvd: 98<br>
> >>>> Warn SOA REFRESH WARNING: Your SOA REFRESH interval is: 900. That is<br>
> >>>> not so ok<br>
> >>>> Warn SOA RETRY Your SOA RETRY value is: 90. That is NOT OK<br>
> >><br>
> ><br>
> > ______________________________<wbr>_________________<br>
> > Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/bind-users</a> to unsubscribe from this list<br>
> ><br>
> > bind-users mailing list<br>
> > <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
> > <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/bind-users</a><br>
><br>
><br>
><br>
> --<br>
> John Miller<br>
> Senior Systems Engineer<br>
> Brandeis University ITS<br>
> <a href="mailto:johnmill@brandeis.edu">johnmill@brandeis.edu</a><br>
> (781) 736-4619<br>
> ______________________________<wbr>_________________<br>
> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/bind-users</a> to unsubscribe from this list<br>
><br>
> bind-users mailing list<br>
> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/bind-users</a><br>
<br>
<br>
<br>
</div></div><span class="HOEnZb"><font color="#888888">-- <br>
I don't think the execution is relevant when it was obviously a bad<br>
idea in the first place.<br>
This is like putting rabid weasels in your pants, and later expressing<br>
regret at having chosen those particular rabid weasels and that pair<br>
of pants.<br>
---maf<br>
</font></span><div class="HOEnZb"><div class="h5">______________________________<wbr>_________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/bind-users</a><br>
</div></div></blockquote></div><br></div>