<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>I'm seeing strange behavior with a BIND 9.18.24 resolver and
dnssec-failed.org.</p>
<p>With no dnssec-validation line (or with "dnssec-validation auto")
in the .conf, querying for <a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a> returns SERVFAIL,
as expected . . until it doesn't. After several seconds of
answering SERVFAIL, I start getting NOERROR responses, and IP
addresses in the ANSWER. It isn't a predictable number of seconds;
sometimes 9, sometimes 20.</p>
<p>Is this supposed to be happening?<br>
</p>
<p>When I examine the process with delv and my eyeballs, I can't see
why it is succeeding with dig and my validating resolver.</p>
<p>Maybe I'm not looking for the right things with my eyeballs? I'm
stumped, and looking for advice for nest-steps in understanding
what's going on.</p>
<p><br>
</p>
<p>The following one-liner:</p>
<p># rndc flush && while true; do dig -4
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. A @localhost; sleep 1; done</p>
<p>Results in answers like:</p>
<p>
<blockquote type="cite">; <<>> DiG 9.18.24
<<>> -4 <a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. A @localhost<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id:
62774<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0,
ADDITIONAL: 1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 1232<br>
; COOKIE: 9fd5ae2d4566c51d01000000661f07f2bfc240421b91f851
(good)<br>
;; QUESTION SECTION:<br>
;www.dnssec-failed.org. IN A<br>
<br>
;; Query time: 237 msec<br>
;; SERVER: 127.0.0.1#53(localhost) (UDP)<br>
;; WHEN: Tue Apr 16 15:21:22 AKDT 2024<br>
;; MSG SIZE rcvd: 78<br>
<br>
<br>
; <<>> DiG 9.18.24 <<>> -4
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. A @localhost<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id:
7693<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0,
ADDITIONAL: 1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 1232<br>
; COOKIE: 90175bca7b323c8301000000661f07f3467dc5a561eb4f77
(good)<br>
;; QUESTION SECTION:<br>
;www.dnssec-failed.org. IN A<br>
<br>
;; Query time: 1 msec<br>
;; SERVER: 127.0.0.1#53(localhost) (UDP)<br>
;; WHEN: Tue Apr 16 15:21:23 AKDT 2024<br>
;; MSG SIZE rcvd: 78</blockquote>
--- after ~20 more like those ---</p>
<p>
<blockquote type="cite">; <<>> DiG 9.18.24
<<>> -4 <a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. A @localhost<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
34572<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0,
ADDITIONAL: 1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 1232<br>
; COOKIE: 60f5a11077dc972401000000661f0809905b6096fd5e287a
(good)<br>
;; QUESTION SECTION:<br>
;www.dnssec-failed.org. IN A<br>
<br>
;; ANSWER SECTION:<br>
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. 7199 IN A 68.87.109.242<br>
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. 7199 IN A 69.252.193.191<br>
<br>
;; Query time: 0 msec<br>
;; SERVER: 127.0.0.1#53(localhost) (UDP)<br>
;; WHEN: Tue Apr 16 15:21:45 AKDT 2024<br>
;; MSG SIZE rcvd: 110<br>
<br>
<br>
; <<>> DiG 9.18.24 <<>> -4
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. A @localhost<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
2987<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0,
ADDITIONAL: 1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 1232<br>
; COOKIE: 89a4502552606c3701000000661f080a5dd5f9299ddb95fe
(good)<br>
;; QUESTION SECTION:<br>
;www.dnssec-failed.org. IN A<br>
<br>
;; ANSWER SECTION:<br>
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. 7198 IN A 68.87.109.242<br>
<a class="moz-txt-link-abbreviated" href="http://www.dnssec-failed.org">www.dnssec-failed.org</a>. 7198 IN A 69.252.193.191<br>
<br>
;; Query time: 0 msec<br>
;; SERVER: 127.0.0.1#53(localhost) (UDP)<br>
;; WHEN: Tue Apr 16 15:21:46 AKDT 2024<br>
;; MSG SIZE rcvd: 110</blockquote>
<br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
</body>
</html>