<div dir="ltr"><div>Yes, bypassing DNSSEC Validation seems to have a solution.</div><div><br></div><div>Thanks for the help.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 30, 2023 at 7:30 PM Bhangui, Sandeep - BLS CTR via bind-users <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg8181238969450748732">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_8181238969450748732WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">This seems to be an issue with the domain <a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">DNSSEC looks like is broken for that domain.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">NS servers at our location also cannot resolve that directly but if I forward that query to any ISP provider NS which are more lax it resolves just fine.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Thanks<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Sandeep<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(225,225,225) currentcolor currentcolor;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> bind-users <<a href="mailto:bind-users-bounces@lists.isc.org" target="_blank">bind-users-bounces@lists.isc.org</a>>
<b>On Behalf Of </b>John W. Blue via bind-users<br>
<b>Sent:</b> Wednesday, August 30, 2023 9:39 AM<br>
<b>To:</b> bind-users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
<b>Subject:</b> RE: Facing issues while resolving only one record<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:12pt;background:red"><strong><span style="font-size:10pt;font-family:"Calibri",sans-serif;color:white">CAUTION</span></strong><span style="font-size:10pt;font-family:"Calibri",sans-serif;color:white">:
<strong><span style="font-family:"Calibri",sans-serif">This email originated from outside of BLS. DO NOT click (select) links or open attachments unless you recognize the sender and know the content is safe. Please report suspicious emails through the “Phish
Alert Report” button on your email toolbar. </span></strong></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Recommend you turn off DNSSEC validation and see if it starts working.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">If it does, then you know the issue is with how DNSSEC is configured on your server.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">John<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> bind-users [<a href="mailto:bind-users-bounces@lists.isc.org" target="_blank">mailto:bind-users-bounces@lists.isc.org</a>]
<b>On Behalf Of </b>Blason R<br>
<b>Sent:</b> Wednesday, August 30, 2023 8:20 AM<br>
<b>To:</b> bind-users<br>
<b>Subject:</b> Facing issues while resolving only one record<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Hi all,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I have bind BIND 9.18.17-1+ubuntu22.04.1+isc+1-Ubuntu (Extended Support Version)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">And I am facing this weird issue. Somehow <a href="http://eportal.incometax.gov.in" target="_blank">
eportal.incometax.gov.in</a> site is not getting resolved through DNS.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I tried a lot but unfortunately the issue still persists.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Here are packet capture logs.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes<br>
18:47:19.569999 ens18 In IP 192.168.1.162.61110 > 192.168.1.133.53: 20+ A? <a href="http://eportal.incometax.gov.in" target="_blank">
eportal.incometax.gov.in</a>. (42)<br>
18:47:19.587705 ens18 Out IP 192.168.1.133.40263 > 208.67.222.222.53: 30627+% [1au] A?
<a href="http://eportal.incometax.gov.in" target="_blank">eportal.incometax.gov.in</a>. (65)<br>
18:47:19.599214 ens18 Out IP 192.168.1.133.44299 > 1.1.1.1.53: 62952+% [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:20.800736 ens18 Out IP 192.168.1.133.56154 > 8.8.8.8.53: 16152+% [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:21.573628 ens18 In IP 192.168.1.162.53536 > 192.168.1.133.53: 21+ AAAA? <a href="http://eportal.incometax.gov.in" target="_blank">
eportal.incometax.gov.in</a>. (42)<br>
18:47:21.576427 ens18 Out IP 192.168.1.133.55356 > 8.8.8.8.53: 57361+% [1au] AAAA?
<a href="http://eportal.incometax.gov.in" target="_blank">eportal.incometax.gov.in</a>. (65)<br>
18:47:22.002738 ens18 Out IP 192.168.1.133.33064 > 208.67.222.222.53: 16204+% [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:22.777934 ens18 Out IP 192.168.1.133.58739 > 208.67.222.222.53: 34205+% [1au] AAAA?
<a href="http://eportal.incometax.gov.in" target="_blank">eportal.incometax.gov.in</a>. (65)<br>
18:47:23.203333 ens18 Out IP 192.168.1.133.60920 > 9.9.9.9.53: 46145+% [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:23.584820 ens18 In IP 192.168.1.162.53962 > 192.168.1.133.53: 22+ A? <a href="http://eportal.incometax.gov.in" target="_blank">
eportal.incometax.gov.in</a>. (42)<br>
18:47:24.405041 ens18 Out IP 192.168.1.133.56475 > 198.41.0.4.53: 12349 [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:25.205136 ens18 Out IP 192.168.1.133.33517 > 192.36.148.17.53: 18768 [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:25.237837 ens18 Out IP 192.168.1.133.43646 > 156.154.100.20.53: 28883 [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:25.259888 ens18 Out IP 192.168.1.133.51762 > 59.160.103.171.53: 46716 [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<br>
18:47:25.597312 ens18 In IP 192.168.1.162.53963 > 192.168.1.133.53: 23+ AAAA? <a href="http://eportal.incometax.gov.in" target="_blank">
eportal.incometax.gov.in</a>. (42)<br>
18:47:26.498891 ens18 Out IP 192.168.1.133.52631 > 125.16.225.122.53: 12762 [1au] DNSKEY?
<a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. (57)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I feel this is something related to DNS RRKEY Record size?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Plus then I dumbdb on my server and went through cache using command<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><b>#rndc dumpdb -all</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">And here is the output<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. 3422 NS <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a>.<br>
3422 NS <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a>.<br>
<a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a>. 131 \-AAAA ;-$NXRRSET<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a>. RRSIG NSEC ...<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a>. NSEC <a href="http://ns02.incometax.gov.in" target="_blank">
ns02.incometax.gov.in</a>. A RRSIG NSEC<br>
; <a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. SOA <a href="http://ns01.incometax.gov.in" target="_blank">
ns01.incometax.gov.in</a>. <a href="http://ns-admin.cpc.incometax.gov.in" target="_blank">ns-admin.cpc.incometax.gov.in</a>. 2023060970 7200 3600 1209600 3600<br>
; <a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. RRSIG SOA ...<br>
<a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a>. 120 \-AAAA ;-$NXRRSET<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a>. RRSIG NSEC ...<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a>. NSEC <a href="http://ns03.incometax.gov.in" target="_blank">
ns03.incometax.gov.in</a>. A RRSIG NSEC<br>
; <a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. SOA <a href="http://ns02.incometax.gov.in" target="_blank">
ns02.incometax.gov.in</a>. <a href="http://ns-admin.cpc.incometax.gov.in" target="_blank">ns-admin.cpc.incometax.gov.in</a>. 2023071447 7200 3600 1209600 3600<br>
; <a href="http://incometax.gov.in" target="_blank">incometax.gov.in</a>. RRSIG SOA ...<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 131] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 120] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 131] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 120] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 131] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 120] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 131] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 120] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 131] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 120] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 130] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 119] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 128] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 117] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 128] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 117] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 128] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 117] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 128] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 117] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 128] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 117] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 125] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 114] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns01.incometax.gov.in" target="_blank">ns01.incometax.gov.in</a> [v6 TTL 124] [v4 unexpected] [v6 nxrrset]<br>
; <a href="http://ns02.incometax.gov.in" target="_blank">ns02.incometax.gov.in</a> [v6 TTL 113] [v4 unexpected] [v6 nxrrset]<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Any idea what could be an issue?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div></blockquote></div>