<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br><br>
<br>
Named should be sending queries with DO=1 and it should be getting back signed responses. I suspect that you will need to run packet captures of the traffic to and from 162.140.15.100 and 162.140.254.200 port 53 from the nameserver. Either signed responses will cease or DNSSEC requests will cease. In either case having the traffic around the transition should help to determine what is happening.<br><br></blockquote><div>I've found that, after a fresh restart of named, if I query for "<a href="http://federalregister.gov">federalregister.gov</a> A" I get a good AD response, and then subsequent queries for "<a href="http://www.federalregister.gov">www.federalregister.gov</a>" are successful as well. If however after a restart of named I begin with a query for <a href="http://www.federalregister.gov">www.federalregister.gov</a> A then I get servfail, and subsequent queries for <a href="http://federealregister.gov">federealregister.gov</a> servfail as well. Here is the tcpdump from the 2nd (failed) case of an initial query for <a href="http://www.federalregister.gov">www.federalregister.gov</a>:</div><div><br></div><div><br></div>reading from file dns.cap, link-type EN10MB (Ethernet), snapshot length 262144<br>04:30:01.114458 IP (tos 0x0, ttl 64, id 35832, offset 0, flags [none], proto UDP (17), length 92)<br> 10.0.0.159.43263 > 162.140.254.200.53: [udp sum ok] 15013 [1au] A? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. ar: . OPT UDPsize=512 DO [COOKIE 352538a87bde87a5] (64)<br>04:30:01.204863 IP (tos 0x0, ttl 229, id 4936, offset 0, flags [DF], proto UDP (17), length 80)<br> 162.140.254.200.53 > 10.0.0.159.43263: [udp sum ok] 15013*-| q: A? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. 3/0/1 . OPT UDPsize=4096 DO [|domain]<br>04:30:01.205350 IP (tos 0x0, ttl 64, id 43065, offset 0, flags [none], proto UDP (17), length 69)<br> 10.0.0.159.59699 > 162.140.254.200.53: [udp sum ok] 50396 A? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. (41)<br>04:30:01.325033 IP (tos 0x0, ttl 229, id 61678, offset 0, flags [DF], proto UDP (17), length 141)<br> 162.140.254.200.53 > 10.0.0.159.59699: [udp sum ok] 50396*- q: A? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. 2/2/0 <a href="http://www.federalregister.gov">www.federalregister.gov</a>. A 99.83.174.136, <a href="http://www.federalregister.gov">www.federalregister.gov</a>. A 75.2.36.59 ns: <a href="http://federalregister.gov">federalregister.gov</a>. NS <a href="http://ns3.gpo.gov">ns3.gpo.gov</a>., <a href="http://federalregister.gov">federalregister.gov</a>. NS <a href="http://ns4.gpo.gov">ns4.gpo.gov</a>. (113)<br>04:30:01.706532 IP (tos 0x0, ttl 64, id 13071, offset 0, flags [none], proto UDP (17), length 92)<br> 10.0.0.159.40399 > 162.140.15.100.53: [udp sum ok] 59408 [1au] DS? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. ar: . OPT UDPsize=512 DO [COOKIE bcd54232244c075a] (64)<br>04:30:01.823027 IP (tos 0x0, ttl 230, id 41740, offset 0, flags [DF], proto UDP (17), length 80)<br> 162.140.15.100.53 > 10.0.0.159.40399: [udp sum ok] 59408*-| q: DS? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. 0/2/1 ns: . OPT UDPsize=4096 DO [|domain]<br>04:30:01.826975 IP (tos 0x0, ttl 64, id 29142, offset 0, flags [none], proto UDP (17), length 69)<br> 10.0.0.159.41463 > 162.140.15.100.53: [udp sum ok] 53452 DS? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. (41)<br>04:30:01.958188 IP (tos 0x0, ttl 230, id 41744, offset 0, flags [DF], proto UDP (17), length 149)<br> 162.140.15.100.53 > 10.0.0.159.41463: [udp sum ok] 53452*- q: DS? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. 0/1/0 ns: <a href="http://federalregister.gov">federalregister.gov</a>. SOA <a href="http://ins1.gpo.gov">ins1.gpo.gov</a>. please_set_email.absolutely.nowhere. 2542629 10800 1080 2592000 900 (121)<br>04:30:01.960633 IP (tos 0x0, ttl 64, id 61049, offset 0, flags [none], proto UDP (17), length 69)<br> 10.0.0.159.47806 > 162.140.254.200.53: [udp sum ok] 3265 DS? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. (41)<br>04:30:02.093679 IP (tos 0x0, ttl 229, id 61713, offset 0, flags [DF], proto UDP (17), length 149)<br> 162.140.254.200.53 > 10.0.0.159.47806: [udp sum ok] 3265*- q: DS? <a href="http://www.federalregister.gov">www.federalregister.gov</a>. 0/1/0 ns: <a href="http://federalregister.gov">federalregister.gov</a>. SOA <a href="http://ins1.gpo.gov">ins1.gpo.gov</a>. please_set_email.absolutely.nowhere. 2542629 10800 1080 2592000 900 (121)<br>04:30:02.095216 IP (tos 0x0, ttl 64, id 53735, offset 0, flags [none], proto UDP (17), length 57)<br> 10.0.0.159.44320 > 162.140.15.100.53: [udp sum ok] 27093 AAAA? <a href="http://ns4.gpo.gov">ns4.gpo.gov</a>. (29)<br>04:30:02.099567 IP (tos 0x0, ttl 64, id 23890, offset 0, flags [none], proto UDP (17), length 57)<br> 10.0.0.159.49556 > 162.140.15.100.53: [udp sum ok] 11719 AAAA? <a href="http://ns3.gpo.gov">ns3.gpo.gov</a>. (29)<br>04:30:02.229242 IP (tos 0x0, ttl 230, id 56543, offset 0, flags [DF], proto UDP (17), length 102)<br> 162.140.15.100.53 > 10.0.0.159.44320: [udp sum ok] 27093*- q: AAAA? <a href="http://ns4.gpo.gov">ns4.gpo.gov</a>. 0/1/0 ns: <a href="http://gpo.gov">gpo.gov</a>. SOA <a href="http://ins1.gpo.gov">ins1.gpo.gov</a>. <a href="http://noc.gpo.gov">noc.gpo.gov</a>. 2010073218 10800 3600 2592000 900 (74)<br>04:30:02.229459 IP (tos 0x0, ttl 230, id 56542, offset 0, flags [DF], proto UDP (17), length 102)<br> 162.140.15.100.53 > 10.0.0.159.49556: [udp sum ok] 11719*- q: AAAA? <a href="http://ns3.gpo.gov">ns3.gpo.gov</a>. 0/1/0 ns: <a href="http://gpo.gov">gpo.gov</a>. SOA <a href="http://ins1.gpo.gov">ins1.gpo.gov</a>. <a href="http://noc.gpo.gov">noc.gpo.gov</a>. 2010073218 10800 3600 2592000 900 (74)</div><div class="gmail_quote"><br></div><div class="gmail_quote">Here is the tcpdump from the 1st successful case of an initial query for <a href="http://federalregister.gov">federalregister.gov</a>:</div><div class="gmail_quote"><br></div><div class="gmail_quote">04:39:02.838690 IP (tos 0x0, ttl 64, id 27981, offset 0, flags [none], proto UDP (17), length 88)<br> 10.0.0.159.41336 > 162.140.15.100.53: [udp sum ok] 45611 [1au] A? <a href="http://federalregister.gov">federalregister.gov</a>. ar: . OPT UDPsize=512 DO [COOKIE 09372246c1a6d91c] (60)<br>04:39:02.924319 IP (tos 0x0, ttl 230, id 28551, offset 0, flags [DF], proto UDP (17), length 506)<br> 162.140.15.100.53 > 10.0.0.159.41336: [udp sum ok] 45611*- q: A? <a href="http://federalregister.gov">federalregister.gov</a>. 3/3/1 <a href="http://federalregister.gov">federalregister.gov</a>. A 75.2.36.59, <a href="http://federalregister.gov">federalregister.gov</a>. A 99.83.174.136, <a href="http://federalregister.gov">federalregister.gov</a>. RRSIG ns: <a href="http://federalregister.gov">federalregister.gov</a>. NS <a href="http://ns4.gpo.gov">ns4.gpo.gov</a>., <a href="http://federalregister.gov">federalregister.gov</a>. NS <a href="http://ns3.gpo.gov">ns3.gpo.gov</a>., <a href="http://federalregister.gov">federalregister.gov</a>. RRSIG ar: . OPT UDPsize=4096 DO (478)<br>04:39:02.925207 IP (tos 0x0, ttl 64, id 22272, offset 0, flags [none], proto UDP (17), length 88)<br> 10.0.0.159.36187 > 162.140.254.200.53: [udp sum ok] 44463 [1au] DNSKEY? <a href="http://federalregister.gov">federalregister.gov</a>. ar: . OPT UDPsize=512 DO [COOKIE cc687621d8684958] (60)<br>04:39:03.008409 IP (tos 0x0, ttl 229, id 32759, offset 0, flags [DF], proto UDP (17), length 76)<br> 162.140.254.200.53 > 10.0.0.159.36187: [udp sum ok] 44463*-| q: DNSKEY? <a href="http://federalregister.gov">federalregister.gov</a>. 0/0/1 ar: . OPT UDPsize=4096 DO (48)<br>04:39:03.008785 IP (tos 0x0, ttl 64, id 53226, offset 0, flags [none], proto TCP (6), length 60)<br> 10.0.0.159.55681 > 162.140.254.200.53: Flags [S], cksum 0x5d5f (correct), seq 4261541886, win 64240, options [mss 1460,sackOK,TS val 682249050 ecr 0,nop,wscale 7], length 0<br>04:39:03.095133 IP (tos 0x0, ttl 229, id 32783, offset 0, flags [DF], proto TCP (6), length 60)<br> 162.140.254.200.53 > 10.0.0.159.55681: Flags [S.], cksum 0x7ae4 (correct), seq 1529080310, ack 4261541887, win 13800, options [mss 1380,nop,wscale 0,sackOK,TS val 3817897758 ecr 682249050], length 0<br>04:39:03.095209 IP (tos 0x0, ttl 64, id 53227, offset 0, flags [none], proto TCP (6), length 52)<br> 10.0.0.159.55681 > 162.140.254.200.53: Flags [.], cksum 0xdcf5 (correct), seq 1, ack 1, win 502, options [nop,nop,TS val 682249136 ecr 3817897758], length 0<br>04:39:03.095408 IP (tos 0x0, ttl 64, id 53228, offset 0, flags [none], proto TCP (6), length 114)<br> 10.0.0.159.55681 > 162.140.254.200.53: Flags [P.], cksum 0x0a81 (correct), seq 1:63, ack 1, win 502, options [nop,nop,TS val 682249137 ecr 3817897758], length 62 22096 [1au] DNSKEY? <a href="http://federalregister.gov">federalregister.gov</a>. ar: . OPT UDPsize=1232 DO [COOKIE cc687621d8684958] (60)<br>04:39:03.183481 IP (tos 0x0, ttl 229, id 32793, offset 0, flags [DF], proto TCP (6), length 52)<br> 162.140.254.200.53 > 10.0.0.159.55681: Flags [.], cksum 0xa82a (correct), seq 1, ack 63, win 13862, options [nop,nop,TS val 3817897850 ecr 682249137], length 0<br>04:39:03.187960 IP (tos 0x0, ttl 229, id 32794, offset 0, flags [DF], proto TCP (6), length 1160)<br> 162.140.254.200.53 > 10.0.0.159.55681: Flags [P.], cksum 0xca8d (correct), seq 1:1109, ack 63, win 13862, options [nop,nop,TS val 3817897850 ecr 682249137], length 1108 22096*- q: DNSKEY? <a href="http://federalregister.gov">federalregister.gov</a>. 5/0/1 <a href="http://federalregister.gov">federalregister.gov</a>. DNSKEY, <a href="http://federalregister.gov">federalregister.gov</a>. DNSKEY, <a href="http://federalregister.gov">federalregister.gov</a>. DNSKEY, <a href="http://federalregister.gov">federalregister.gov</a>. RRSIG, <a href="http://federalregister.gov">federalregister.gov</a>. RRSIG ar: . OPT UDPsize=4096 DO (1106)<br>04:39:03.187995 IP (tos 0x0, ttl 64, id 53229, offset 0, flags [none], proto TCP (6), length 52)<br> 10.0.0.159.55681 > 162.140.254.200.53: Flags [.], cksum 0xd7ab (correct), seq 63, ack 1109, win 501, options [nop,nop,TS val 682249229 ecr 3817897850], length 0<br>04:39:03.189604 IP (tos 0x0, ttl 64, id 53230, offset 0, flags [none], proto TCP (6), length 52)<br> 10.0.0.159.55681 > 162.140.254.200.53: Flags [F.], cksum 0xd7a8 (correct), seq 63, ack 1109, win 501, options [nop,nop,TS val 682249231 ecr 3817897850], length 0<br>04:39:03.486320 IP (tos 0x0, ttl 64, id 53231, offset 0, flags [none], proto TCP (6), length 52)<br> 10.0.0.159.55681 > 162.140.254.200.53: Flags [F.], cksum 0xd67f (correct), seq 63, ack 1109, win 501, options [nop,nop,TS val 682249528 ecr 3817897850], length 0<br></div><div class="gmail_quote"><br></div><div class="gmail_quote">Both dumps were filtered to only traffic to/from the authoritative servers 162.140.15.100 and 162.140.254.200.</div><div class="gmail_quote"><br></div><div class="gmail_quote">This particular system is running 9.16.33-Raspbian.<br><div> </div></div></div>