FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.

» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian User

LinkBack Thread Tools
Old 10-03-2011, 02:40 PM
"Sergio Charpinel Jr."
Default bind9: DNSSEC SERVFAIL when zone has no DS record


Dig returns SERVFAIL while trying to resolve a dnssec enabled zone
without DS record in parent zone. For example, I have these two DNSSEC
enabled zones:

domain.com zone has NO DS record for subdomain.domain.com zone, and
subdomain.domain.com has an A record for the zone, and an A record for
www .

If I query subdomain.domain.com , I get SERVFAIL from dig and these
log messages:

03-Oct-2011 11:03:07.893 validating @0x7f9ea305b2d0: domain.com SOA:
no valid signature found
03-Oct-2011 11:03:07.894 createfetch: domain.com DS
03-Oct-2011 11:03:07.894 validating @0x7f9ea305df70: domain.com
NSEC: no valid signature found
03-Oct-2011 11:03:07.895 createfetch: domain.com DS
03-Oct-2011 11:03:07.896 error (broken trust chain) resolving
'subdomain.domain.com/DNSKEY/IN': x.x.x.x#53
03-Oct-2011 11:03:07.896 error (broken trust chain) resolving
'subdomain.domain.com/A/IN': x.x.x.x#53

If I run the query again, I get NXDOMAIN (from cache). So I can't
query subdomain.domain.com zone.

Now, if I query www.subdomain.domain.com I get the same, but when I
run the query again I get a valid answer (from cache).

I know the DS is not configured properly and so DNSSEC shouldn't work,
but bind shouldn't behave like this. If the zone is not configured
properly, bind should query it anyway, the same way it does when the
zone isn't signed.

I didn't find any related bugs.

Btw, I'm using bind 9.7.3 from debian 6.0.2.


Sergio Roberto Charpinel Jr.

To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: CAJd0DBb9ZvoZCpRagYYwpRC7kJseYDh8Lfeb4MV5hD-f1p2q6w@mail.gmail.com">http://lists.debian.org/CAJd0DBb9ZvoZCpRagYYwpRC7kJseYDh8Lfeb4MV5hD-f1p2q6w@mail.gmail.com

Thread Tools

All times are GMT. The time now is 10:31 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org