Re: [public-dns-discuss] BIND server unable to resolve debian.org with DNSSEC enabled

[Yunhong Gu]

debian.org was failing DNSSEC validation on May 9. The problem has been fixed on the same day.

On Thu, May 9, 2013 at 9:25 PM, Aaron Riekenberg <aaron.ri...@gmail.com> wrote:

I have a BIND 9 server forwarding to 8.8.8.8 and 8.8.4.4.  

Today I'm finding my server can't resolve debian.org when DNSSEC is enabled, but it works with DNSSEC disabled.  All other domains I've tried work with DNSSEC enabled.  

debian.org worked with DNSSEC enabled with this same configuration yesterday.

Errors from BIND trying to resolve debian.org with dnssec enabled:

May  9 20:05:42 server named[10105]: error (broken trust chain) resolving 'www.debian.org/A/IN': 8.8.8.8#53

May  9 20:05:58 server named[10105]:       validating @0x7f731802ea10: debian.org DNSKEY: bad cache hit (debian.org/DS)

May  9 20:05:58 server named[10105]: error (broken trust chain) resolving 'www.debian.org/A/IN': 8.8.8.8#53

May  9 20:06:08 server named[10105]:   validating @0x7f7325394260: debian.org DNSKEY: bad cache hit (debian.org/DS)

May  9 20:06:08 server named[10105]: error (broken trust chain) resolving 'debian.org/A/IN': 8.8.4.4#53

May  9 20:07:17 server named[10105]:   validating @0x7f731801c110: debian.org DNSKEY: bad cache hit (debian.org/DS)

May  9 20:07:17 server named[10105]: error (broken trust chain) resolving 'debian.org/A/IN': 8.8.8.8#53

May  9 20:13:58 server named[10105]: error (no valid RRSIG) resolving 'debian.org/DS/IN': 8.8.4.4#53

May  9 20:13:58 server named[10105]: error (no valid RRSIG) resolving 'debian.org/DS/IN': 8.8.8.8#53

May  9 20:13:58 server named[10105]: error (broken trust chain) resolving 'debian.org/A/IN': 8.8.4.4#53

--
--
========================================================
You received this message because you are subscribed to the Google
Groups "public-dns-discuss" group.
To post to this group, send email to public-dn...@googlegroups.com
To unsubscribe from this group, send email to
public-dns-disc...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/public-dns-discuss?hl=en
For more information on Google Public DNS, please visit
http://code.google.com/speed/public-dns
========================================================
 
---
You received this message because you are subscribed to the Google Groups "public-dns-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to public-dns-disc...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.