<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta content="text/html; charset=utf-8">
</head>
<body>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; line-height:1.3; color:#1F497D">
<div>Your using the wrong tools to troubleshoot or investigate this error.<br>
<br>
Instead of relying upon resolvers to provide situational awareness you need to inspect DNSSEC itself using dnsviz.net:<br>
<br>
<a href="https://dnsviz.net/d/pms.psc.gov/dnssec/">https://dnsviz.net/d/pms.psc.gov/dnssec/</a><br>
<br>
psc.gov is giving the world ID 5089 when they need to handing out ID 180.<br>
<br>
Recommend the pms.psc.gov admins give the psc.gov admins the correct hash.<br>
<br>
</div>
<div id="signature-x" class="signature_editor" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; color:#1F497D">
Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a><br>
</div>
</div>
<div id="quoted_header" style="clear:both">
<hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1">
<div style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt; font-family:'Calibri','sans-serif'"><b>From:</b> Roger Hammerstein <cheeky.m@gmx.com><br>
<b>Sent:</b> Sunday, August 22, 2021 9:45 AM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> unresolvable pms.psc.gov, but google/cloudflare/unbound work<br>
</span></div>
</div>
<br type="attribution">
<div>
<div style="font-family:Verdana; font-size:12.0px">
<div><br>
pms.psc.gov appears to be unresolvable against bind9.16.19<br>
and 9.11.34 because of dnssec issues.<br>
But it resolves against Cloudflare's 1.1.1.1, Google's 8.8.8.8, and an Unbound<br>
resolver that does dnssec-validation.</div>
<div> </div>
<div>There's a ticket open with nih.gov to look into it, but is there anything that can<br>
be changed with Bind to make this domain resolve in the meantime?</div>
<div> </div>
<div> (pms.psc.gov): query failed (SERVFAIL) for pms.psc.gov/IN/A at query.c:8678</div>
<div><br>
https://dnsviz.net/d/pms.psc.gov/dnssec/<br>
https://dnssec-analyzer.verisignlabs.com/pms.psc.gov</div>
<div><br>
dig a pms.psc.gov @8.8.8.8</div>
<div>pms.psc.gov. 2852 IN CNAME pms.ha.psc.gov.<br>
pms.ha.psc.gov. 29 IN A 156.40.178.24</div>
<div> </div>
<div> </div>
<div>
<div> </div>
<div>dig a pms.psc.gov @8.8.8.8 +dnssec</div>
<div><br>
;; ANSWER SECTION:<br>
pms.psc.gov. 2835 IN CNAME pms.ha.psc.gov.<br>
pms.psc.gov. 2835 IN RRSIG CNAME 8 3 3600 20210827000144 20210821230144 5089 psc.gov. kpclRfRyBqaSGW6VrpkE4gP/QPfggKZTVb68npiosnt+4lIUglUxino5 jQAqd9a1p8HbdHG63HPnfYYBq1bX9q/f11CVUmxXXJUbRBGTZBnDyATP LLI2GWSZ1at364O+C+iZozi8NpJNU4oTCfd3PLScFbOfSGbPyRfUzfvB
AJc=<br>
pms.ha.psc.gov. 29 IN A 156.40.178.24<br>
pms.ha.psc.gov. 29 IN RRSIG A 7 4 30 20210827185442 20210820185442 21380 ha.psc.gov. w2XUqBVoBMtLv0qfc5xmccrpv+w2ukwGfaGJvthIKHXr2SdlAk3oQxve xyolEaj2zWn8Uj7lOsaZD8mewBMQ3iEEp8U96aFBslWV/ffEKL+H9oMM sUNU5KwNi7/Nk3KZuNc8R3xxuYTsSVdbu6ai1lQ6fmw2uWAoDP9YIqek
jyo/0WFSXM+hxw/5WguijhilSRIywNgG3/6MY3ZmunPPafGTCTXigyex IBACJQJ+meD6vMi0YoRM17mwdD+7Buq2cb6LJyVYaQImh7M2gF8My75n lDns4PWEIx4bSW2uQQEPpB7MA9VI9y5CuVCmqC3wMZ2ow6G8pkaf18wv r/ucSQ==</div>
<div> </div>
<div> </div>
<div> </div>
<div>
<div> </div>
<div>I can sometimes get a servfail out of 8.8.8.8 with an any query<br>
dig any pms.psc.gov @8.8.8.8 +dnssec</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36332<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags: do; udp: 512<br>
;; QUESTION SECTION:<br>
;pms.psc.gov. IN ANY<br>
;; Query time: 5001 msec</div>
<div> </div>
</div>
</div>
</div>
</div>
</body>
</html>