<div dir="ltr"><div>Hello.</div><div>What version of BIND are you running?</div><div><br></div><div>By default, BIND will attempt to perform DNSSEC validation, which is probably why you're seeing the DS query. See here for more information on validation and DNSSEC in general: <a href="https://bind9.readthedocs.io/en/latest/dnssec-guide.html#dnssec-validation-explained">https://bind9.readthedocs.io/en/latest/dnssec-guide.html#dnssec-validation-explained</a></div><div><br></div><div>You might want to leave validation enabled in general, but disable it for domains that you know are not signed, like "my-home.net.lan". Take a look at this configuration statement: <a href="https://bind9.readthedocs.io/en/latest/reference.html#namedconf-statement-validate-except">https://bind9.readthedocs.io/en/latest/reference.html#namedconf-statement-validate-except</a></div><div><br></div><div>I hope that helps.</div><div>Cheers, Greg</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 13 Sept 2025 at 19:08, Jarrod Spencer Farrell <<a href="mailto:jarrodmaddy@gmail.com" target="_blank">jarrodmaddy@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">That changes the response to ServFail, but probably appropriate on what I'm doing when reading into the option. (<a href="https://serverfault.com/a/1001622" rel="noreferrer" target="_blank">https://serverfault.com/a/1001622</a>)<br>
<br>
And watching `tcpdump` with me asking via `dig` without the extra clutter I was getting from my phone, I am noticing I missed another query being made when previously there was a lot of noise from my phone.<br>
<br>
```<br>
IP 10.0.10.3.38966 > 10.0.10.100.53: 32932+ [1au] A? firewall.my-home.net.lan. (62)<br>
IP 10.0.10.100.7337 > 10.0.10.101.53: 6902+% [1au] A? firewall.my-home.net.lan. (62)<br>
IP 10.0.10.101.53 > 10.0.10.100.7337: 6902* 1/0/1 A 10.96.48.1 (66)<br>
IP 10.0.10.100.53823 > 10.0.10.101.53: 57793+% [1au] DS? firewall.my-home.net.lan. (62)<br>
IP 10.0.10.101.53 > 10.0.10.100.53823: 57793* 0/0/1 (50)<br>
IP 10.0.10.100.53 > 10.0.10.3.38966: 32932 ServFail 0/0/1 (78)<br>
```<br>
<br>
The VPS is asking for a DS answer. This seems to be a DNSSEC thing, and I don't think I need DNSSEC for this zone in particular.<br>
<br>
I did notice `dnssec-must-be-secure` got deprecated and removed, so I removed it from my configuration. (<a href="https://gitlab.isc.org/isc-projects/bind9/-/issues/4263" rel="noreferrer" target="_blank">https://gitlab.isc.org/isc-projects/bind9/-/issues/4263</a>) I saw it in passing when searching for options and felt relevant to add in the config. Removing it doesn't change what the VPS does.<br>
<br>
```named.conf<br>
include "/etc/bind/rndc.key";<br>
controls {<br>
inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};<br>
};<br>
<br>
acl cachenetworks { <a href="http://127.0.0.0/24" rel="noreferrer" target="_blank">127.0.0.0/24</a>; ::1/128; <a href="http://10.0.10.0/24" rel="noreferrer" target="_blank">10.0.10.0/24</a>; };<br>
acl badnetworks { };<br>
<br>
options {<br>
listen-on { any; };<br>
listen-on-v6 { any; };<br>
allow-query-cache { cachenetworks; };<br>
blackhole { badnetworks; };<br>
forward first;<br>
forwarders { 9.9.9.9; 149.112.112.112; 2620:fe::fe; 2620:fe::9; };<br>
directory "/run/named";<br>
pid-file "/run/named/named.pid";<br>
<br>
};<br>
<br>
zone "my-home.net.lan" {<br>
type forward;<br>
forward only;<br>
forwarders { 10.0.10.101; };<br>
};<br>
```<br>
<br>
On 9/13/25 01:49, Mark Andrews wrote:<br>
> Use “forward only:” for your local zones.<br>
<br>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list.<br>
</blockquote></div>