<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2/09/22 08:09, Bhangui, Sandeep -
BLS CTR via bind-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:BY3PR09MB865843DDE72AF0168DFF6C12EF7B9@BY3PR09MB8658.namprd09.prod.outlook.com"><font
size="2" face="Calibri"><span style="font-size:11pt;">
<div># nslookup <a href="http://www.ssa.gov"
moz-do-not-send="true"><font color="#0563C1"><u>www.ssa.gov</u></font></a></div>
<div> </div>
<div><span style="background-color:yellow;">;; Got SERVFAIL
reply from 127.0.0.1, trying next server</span></div>
<div> </div>
<div>Server: 198.6.1.1</div>
<div>Address: 198.6.1.1#53</div>
<div> </div>
<div>Non-authoritative answer:</div>
</span></font></blockquote>
<p><font size="2"><font face="Calibri">Hi Sandeep.</font></font></p>
<p><font size="2"><font face="Calibri">This looks like when you use
nslookup it is using 127.0.0.1 as your DNS server, but when
you use dig it isn't. Do you have systemd on that machine? If
so, I suspect your requests using nslookup are going to the
systemd-resolved stub resolver?</font></font></p>
<p><font size="2"><font face="Calibri"><font size="2"><font
face="Calibri">FYI I know that there were issues with the
stub resolver and DNSSEC lookups, but I don't recall
exactly what the issues were and so I'm not sure if those
limitations have been resolved by now?</font></font></font></font></p>
<p><font size="2"><font face="Calibri">If this is your situation,
then you may want to consider disabling the stub resolver?
Have a look at "man resolved.conf" and in particular the
option you want to set is "DNSStubListener=no". The preferred
way to do this is to create a .conf file with this in
/etc/systemd/resolved.conf.d/ directory, e.g.:</font></font></p>
<blockquote>
<p><font size="2"><font face="Calibri">$ cat
/etc/systemd/resolved.conf.d/00-nick.conf</font></font><br>
<font size="2"><font face="Calibri">[Resolve]</font></font><br>
<font size="2"><font face="Calibri">FallbackDNS=192.168.20.195
192.168.20.196 192.168.20.197</font></font><br>
<font size="2"><font face="Calibri">DNSSEC=yes</font></font><br>
<font size="2"><font face="Calibri">DNSStubListener=no</font></font><font
size="2"><font face="Calibri"><br>
</font></font></p>
</blockquote>
<p><font size="2"><font face="Calibri">After editing the
configuration run "sudo systemctl restart systemd-resolved".<br>
</font></font></p>
<p><font size="2"><font face="Calibri">Nick.<br>
</font></font></p>
</body>
</html>