<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<style>
<!--
.EmailQuote
{margin-left:1pt;
padding-left:4pt;
border-left:#800000 2px solid}
-->
</style>
</head>
<body>
<div id="nine_body_n182fad-b9bf1" class="nine_body" dir="auto" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; line-height:1.3; color:#1F497D">
<div class="nine-pg" dir="auto">Sandeep,</div>
<div class="nine-pg" dir="auto"><br>
</div>
<div class="nine-pg" dir="auto">Are you all using CISA's Protective DNS? If so, there might be a ruleset that is causing problems.</div>
<div class="nine-pg" dir="auto"><br>
</div>
<div class="nine-pg" dir="auto">If not, and I have not checked, but is DNSSEC for SSA working correctly?</div>
<div class="nine-pg" dir="auto"><br>
</div>
<div class="nine-pg" dir="auto">John</div>
<div class="nine-pg blank sign" dir="auto"><br>
</div>
<div id="nine-sign-n182fad-b9bf1" class="nine_signature" dir="auto">
<div class="nine-pg" dir="auto">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a></div>
</div>
<div class="nine-pg blank msg" dir="auto"><br>
</div>
</div>
<div class="quoted_output_body">
<div id="quoted_header_n182fad-b9bf1" class="quoted_header_editor" dir="auto">
<hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1">
<div dir="auto" style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt; font-family:Calibri,Arial,Helvetica,sans-serif"><b>From:</b> "Bhangui, Sandeep - BLS CTR via bind-users" <bind-users@lists.isc.org><br>
<b>Sent:</b> Thursday, September 1, 2022 3:11 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Issue with dns resolution for www.ssa.gov<br>
</span></div>
</div>
<br type="attribution">
</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt">
<div>Hi</div>
<div> </div>
<div>We are running Bind Version 9.16.31 on RHEL 7.X Server and things are working fine in general.</div>
<div> </div>
<div>Having issue with DNS resolution for <a href="http://www.ssa.gov"><font color="#0563C1"><u>www.ssa.gov</u></font></a> no other DNS issues reported at this time.</div>
<div> </div>
<div>Our DNS server cannot seem to resolve <a href="http://www.ssa.gov"><font color="#0563C1"><u>www.ssa.gov</u></font></a> using nslookup ( know this is an old utility and cannot be used much for troubleshooting), dig seems to respond properly.</div>
<div> </div>
<div>Just curious what could be the issue is this on our DNS server as nslookup seems to work fine for lot of other sites that I used just to check if it responds correctly.</div>
<div> </div>
<div>The VZ public NS which is listed as one of the NS under /etc/resolv.conf seems to respond to nslookup just fine.</div>
<div> </div>
<div>I am not sure what more information I could include which could be helpful if anything else is needed please let me know and I will post it.</div>
<div> </div>
<div>Thanks in advance.</div>
<div> </div>
<div>Sandeep</div>
<div> </div>
<div> </div>
<div># nslookup <a href="http://www.ssa.gov"><font color="#0563C1"><u>www.ssa.gov</u></font></a></div>
<div> </div>
<div><span style="background-color:yellow">;; Got SERVFAIL reply from 127.0.0.1, trying next server</span></div>
<div> </div>
<div>Server: 198.6.1.1</div>
<div>Address: 198.6.1.1#53</div>
<div> </div>
<div>Non-authoritative answer:</div>
<div><a href="http://www.ssa.gov">www.ssa.gov</a> canonical name = <a href="http://www.ssa.gov.edgekey.net">
www.ssa.gov.edgekey.net</a>.</div>
<div><a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a> canonical name = e82396.dsca.akamaiedge.net.</div>
<div>Name: e82396.dsca.akamaiedge.net</div>
<div>Address: 23.222.241.54</div>
<div>Name: e82396.dsca.akamaiedge.net</div>
<div>Address: 23.222.241.58</div>
<div>Name: e82396.dsca.akamaiedge.net</div>
<div>Address: 2600:1404:d400::687d:293</div>
<div>Name: e82396.dsca.akamaiedge.net</div>
<div>Address: 2600:1404:d400::687d:289</div>
<div> </div>
<div> </div>
<div><span style="background-color:yellow">Dig output from the same DNS server seems to
</span><span style="background-color:yellow">give a</span><span style="background-color:yellow">
</span><span style="background-color:yellow">response.</span></div>
<div> </div>
<div># <span style="background-color:yellow">dig <a href="http://www.ssa.gov">www.ssa.gov</a></span></div>
<div> </div>
<div>; <<>> DiG 9.16.31 <<>> <a href="http://www.ssa.gov">www.ssa.gov</a></div>
<div>;; global options: +cmd</div>
<div>;; Got answer:</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24578</div>
<div>;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1</div>
<div> </div>
<div>;; OPT PSEUDOSECTION:</div>
<div>; EDNS: version: 0, flags:; udp: 512</div>
<div>;; QUESTION SECTION:</div>
<div>;www.ssa.gov. IN A</div>
<div> </div>
<div>;; ANSWER SECTION:</div>
<div><a href="http://www.ssa.gov">www.ssa.gov</a>. 300 IN CNAME
<a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a>.</div>
<div><a href="http://www.ssa.gov.edgekey.net">www.ssa.gov.edgekey.net</a>. 9625 IN CNAME e82396.dsca.akamaiedge.net.</div>
<div>e82396.dsca.akamaiedge.net. 20 IN A 23.222.241.58</div>
<div>e82396.dsca.akamaiedge.net. 20 IN A 23.222.241.51</div>
<div> </div>
<div>;; Query time: 171 msec</div>
<div>;; SERVER: 198.6.1.1#53(198.6.1.1)</div>
<div>;; WHEN: Thu Sep 01 16:03:21 EDT 2022</div>
<div>;; MSG SIZE rcvd: 146</div>
<div> </div>
<div> </div>
</span></font></div>
</body>
</html>