<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello All,</div>
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
We are facing some resolution problems on a CENTOS resolver that deploys bind 9.11.36-S1 with DNSSEC being activated.</div>
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
</div>
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The logs in 'default.logs' shows the current errors :</div>
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span lang="FR-CM" style="font-size:11.0pt; font-family:"Courier New",serif">X-Sep-2022 10:34:29.348 dnssec: info: validating shalltry.com/SOA: bad cache hit (shalltry.com/DS)<br>
X-Sep-2022 10:34:29.363 dnssec: info: validating osupdate2020.shalltry.com/A: bad cache hit (shalltry.com/DS)<br>
X-Sep-2022 10:34:29.411 dnssec: info: validating static.cnews.fr/NSEC: no valid signature found<br>
X-Sep-2022 10:34:29.445 dnssec: info: validating ocsp.comodoca.com.cdn.cloudflare.net/A: bad cache hit (cloudflare.net/DNSKEY)<br>
X-Sep-2022 10:34:29.447 dnssec: info: validating cdn.jsdelivr.net.cdn.cloudflare.net/A: bad cache hit (cloudflare.net/DNSKEY)<br>
X-Sep-2022 10:34:29.558 dnssec: info: validating oshola.shalltry.com/A: bad cache hit (shalltry.com/DS)<br>
X-Sep-2022 10:34:29.567 dnssec: info: validating ds.shalltry.com/A: bad cache hit (shalltry.com/DS)<br>
X-Sep-2022 10:34:29.570 dnssec: info: validating cdn.shalltry.com/A: bad cache hit (shalltry.com/DS)<br>
</span></div>
<div class="elementToProof"><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">Each night we noticed the occurence of a resolution problem (mini crisis) where requestes receive 'ServFail' for random domains, the maximum
recursive clients is also reached along with the appearance of the error in the logs being highly increased. Even known domain names like apple.com and google.com receive 'ServFail' when requested. Once flushing the cache, the situation gets back to normal
and bind starts functionning correctly.</span></div>
<div class="elementToProof"><span style="font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">In fact, by activating dnssec.log, we noticed these errors : 'no walidating signature found'.</span></div>
<div class="elementToProof"><span style="font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">When deactivating DNSSEC, we noticed that there are no more crisis for now.</span></div>
<div class="elementToProof"><span style="font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">Any possible explanation? Have anyone faced this problem before?</span></div>
<div class="elementToProof"><span style="font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div class="elementToProof"><span style="font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">Best regards.</span></div>
<div class="elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span lang="FR-CM" style="font-size:11.0pt; font-family:"Courier New",serif"><br style="">
</span><br>
</div>
</body>
</html>