<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Am 30.10.2023 um 16:59 schrieb Michael Martinell via bind-users <<a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><p class="">Thanks to all who responded. Putting qname-minimization disabled; in named.conf resolves the issue in my testing.<o:p class=""></o:p></p><p class="">I did try specifying relaxed (which appears to be the default), but that didn’t work either.<o:p class=""></o:p></p><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I agree it would be great if the far ends would make sure what they publish is correct, but it will take a large company to push them to do so.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div></div></blockquote><br class=""></div><div><br class=""></div><div>I usually tell people that the other side needs to fix their stuff.</div><div><br class=""></div><div>Mostly happens when people fubar their DNSSEC setup.</div><div>But this name server stuff (more often then not, it’s some Load-Balancer acting as a DNS-server)</div><div><br class=""></div><div>In both cases: I usually ask them if they can be absolutely sure if the other side hasn’t been hacked?</div><div><br class=""></div><div>You don’t go and try to override broken SSL certificate setups with HSTS, do you?</div><div><br class=""></div><div>That said, I’m still on 9.16, too.</div><div><br class=""></div><div><br class=""></div></body></html>