In article <[email protected]>, Mark Andrews <[email protected]> wrote:
> In message <[email protected]>, Chris > Thompson writes: > > On Feb 5 2009, I wrote: > > > > >DLV records for advocaat.pro & advocaten.pro are among the recent > >additions to dlv.isc.org. Using validating recursive nameservers > > >running BIND 9.5.1-P1 (configured to trust dlv.isc.org), I get SERVFAILs > > >looking things up in them, although not consistently. This doesn't > > >happen with non-validating nameservers. > > > > > >I can't work out what is wrong with them. Does anyone else see the > > >same effect? > > > > More info about the "not consistently" bit. With nothing about > > them in the cache ("rndc flushname advocaat.pro") looking up SOA or > > NS records for them gives SERVFAIL. But looking up A records does > > not, and after that SOA and NS lookups work OK as well. > > > > Hmmm... > > The TLD lies. DNSSEC is doing exactly what it is > supposed to do and is blocking ibad answers. This may be coincidence but we had something similar with dell.com servers for a while yesterday - some of our caching servers would return SERVFAIL when looking up either a particular name, premierconfigure.euro.dell.com, or the NS records for dell.com. I was still baffled when it fixed itself. Did anyone else notice anything similar? Sam _______________________________________________ bind-users mailing list [email protected] https://lists.isc.org/mailman/listinfo/bind-users
