Re: debian.org problems with BIND and DNSSEC

[MinJae Hwang]

Hi Aaron,

Could you try the following?

dig @8.8.8.8 +dnssec www.debian.org

It seems to me that 'www.debian.org' works just fine and Google Public DNS returns an authenticated response.

On Thursday, May 9, 2013 6:17:32 PM UTC-7, Aaron Riekenberg wrote:

I have a BIND 9 server set up to use DNSSEC and foward queries to 8.8.8.8 and 8.8.4.4.

Tonight I'm finding my server can't resolve debian.org if DNSSEC is enabled, but it works with DNSSEC disabled.  All other sites I've tried with DNSSEC enabled work fine.  debian.org was working with DNSSEC and this same configuration yesterday.

Errors from bind trying to resolve debian.org with DNSSEC tonight:

May  9 20:05:42 server named[10105]: error (broken trust chain) resolving 'www.debian.org/A/IN': 8.8.8.8#53

May  9 20:05:58 server named[10105]:       validating @0x7f731802ea10: debian.org DNSKEY: bad cache hit (debian.org/DS)

May  9 20:05:58 server named[10105]: error (broken trust chain) resolving 'www.debian.org/A/IN': 8.8.8.8#53

May  9 20:06:08 server named[10105]:   validating @0x7f7325394260: debian.org DNSKEY: bad cache hit (debian.org/DS)

May  9 20:06:08 server named[10105]: error (broken trust chain) resolving 'debian.org/A/IN': 8.8.4.4#53

May  9 20:07:17 server named[10105]:   validating @0x7f731801c110: debian.org DNSKEY: bad cache hit (debian.org/DS)

May  9 20:07:17 server named[10105]: error (broken trust chain) resolving 'debian.org/A/IN': 8.8.8.8#53

May  9 20:13:58 server named[10105]: error (no valid RRSIG) resolving 'debian.org/DS/IN': 8.8.4.4#53

May  9 20:13:58 server named[10105]: error (no valid RRSIG) resolving 'debian.org/DS/IN': 8.8.8.8#53

May  9 20:13:58 server named[10105]: error (broken trust chain) resolving 'debian.org/A/IN': 8.8.4.4#53

[MinJae Hwang]

Yunhong replied that www.debian.org was failing the validation on May, 9th.