<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">John,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have not moved to PDNS as yet.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am not sure about DNSSEC for SSA will check on that.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal">Sandeep<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> <b>
On Behalf Of </b>John W. Blue via bind-users<br>
<b>Sent:</b> Thursday, September 1, 2022 5:03 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: Issue with dns resolution for www.ssa.gov<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><strong><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black">CAUTION</span></strong><span style="font-size:10.0pt;color:black">: This email originated from outside of
BLS. DO NOT click links or open attachments unless you recognize the sender and know the content is safe. Please send suspicious emails as an attachment to
<a href="mailto:SECURE@BLS.GOV">SECURE@BLS.GOV</a>.<br>
<br>
</span><o:p></o:p></p>
<div id="nine_body_n182fad-b9bf1">
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D">Sandeep,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D">Are you all using CISA's Protective DNS? If so, there might be a ruleset that is causing problems.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D">If not, and I have not checked, but is DNSSEC for SSA working correctly?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D">John<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div id="nine-sign-n182fad-b9bf1">
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D">Sent from <a href="http://www.9folders.com/">
<span style="color:#009BDF;text-decoration:none">Nine</span></a><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#1F497D"><o:p> </o:p></span></p>
</div>
</div>
<div>
<div id="quoted_header_n182fad-b9bf1">
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="1" width="100%" noshade="" style="color:#E1E1E1" align="center">
</div>
<div>
<p class="MsoNormal"><b>From:</b> "Bhangui, Sandeep - BLS CTR via bind-users" <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>><br>
<b>Sent:</b> Thursday, September 1, 2022 3:11 PM<br>
<b>To:</b> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<b>Subject:</b> Issue with dns resolution for <a href="http://www.ssa.gov">www.ssa.gov</a><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Hi<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">We are running Bind Version 9.16.31 on RHEL 7.X Server and things are working fine in general.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Having issue with DNS resolution for <a href="http://www.ssa.gov">
<span style="color:#0563C1">www.ssa.gov</span></a> no other DNS issues reported at this time.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Our DNS server cannot seem to resolve <a href="http://www.ssa.gov">
<span style="color:#0563C1">www.ssa.gov</span></a> using nslookup ( know this is an old utility and cannot be used much for troubleshooting), dig seems to respond properly.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Just curious what could be the issue is this on our DNS server as nslookup seems to work fine for lot of other sites that I used just to check if it responds correctly.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The VZ public NS which is listed as one of the NS under /etc/resolv.conf seems to respond to nslookup just fine.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I am not sure what more information I could include which could be helpful if anything else is needed please let me know and I will post it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks in advance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Sandeep<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"># nslookup <a href="http://www.ssa.gov"><span style="color:#0563C1">www.ssa.gov</span></a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black;background:yellow">;; Got SERVFAIL reply from 127.0.0.1, trying next server</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Server: 198.6.1.1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Address: 198.6.1.1#53<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Non-authoritative answer:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.ssa.gov">www.ssa.gov</a> canonical name =
<a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a> canonical name = e82396.dsca.akamaiedge.net.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Name: e82396.dsca.akamaiedge.net<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Address: 23.222.241.54<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Name: e82396.dsca.akamaiedge.net<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Address: 23.222.241.58<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Name: e82396.dsca.akamaiedge.net<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Address: 2600:1404:d400::687d:293<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Name: e82396.dsca.akamaiedge.net<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Address: 2600:1404:d400::687d:289<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black;background:yellow">Dig output from the same DNS server seems to give a response.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"># <span style="color:black;background:yellow">dig <a href="http://www.ssa.gov">
www.ssa.gov</a></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">; <<>> DiG 9.16.31 <<>> <a href="http://www.ssa.gov">www.ssa.gov</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; global options: +cmd<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; Got answer:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24578<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; OPT PSEUDOSECTION:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">; EDNS: version: 0, flags:; udp: 512<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; QUESTION SECTION:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;www.ssa.gov. IN A<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; ANSWER SECTION:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.ssa.gov">www.ssa.gov</a>. 300 IN CNAME
<a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a>. 9625 IN CNAME e82396.dsca.akamaiedge.net.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">e82396.dsca.akamaiedge.net. 20 IN A 23.222.241.58<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">e82396.dsca.akamaiedge.net. 20 IN A 23.222.241.51<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; Query time: 171 msec<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; SERVER: 198.6.1.1#53(198.6.1.1)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; WHEN: Thu Sep 01 16:03:21 EDT 2022<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">;; MSG SIZE rcvd: 146<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>