<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm running BIND 9.18 as a caching resolver with DNSSEC validation enabled. When I configure forwarders to point at my ISP's DNS, some DNSSEC-signed domains return SERVFAIL even though they validate fine when querying root servers directly.</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My named.conf has:</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
options {</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
dnssec-validation auto;</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
forwarders { 192.168.1.1; };</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
forward only;</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
};</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Domains like cloudflare.com and google.com resolve fine, but a few smaller domains with DS records at the parent return SERVFAIL. If I remove the forwarders block and let BIND do full recursion, same domains resolve perfectly.</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My guess is the ISP's resolver is stripping or mangling the DNSSEC RRSIGs before forwarding back to me, so BIND can't validate the chain. But I'm not sure how to confirm this without manually digging through the chain.</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I've been cross-checking results using <a href="https://dnsrobot.net/dns-lookup" data-outlook-id="f9c805ad-d322-46a8-b9ab-8eea814a9f12">
https://dnsrobot.net/dns-lookup</a> to query different public resolvers and compare whether they return the RRSIG records. Helps narrow down if it's my forwarder dropping them or if the zone itself has issues.</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is there a way to tell BIND to fall back to full recursion when forwarded DNSSEC validation fails? Or should I just stop using forwarders entirely for a validating resolver?</div>
<div style="direction: ltr; font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks</div>
</body>
</html>