* Florian Weimer: > * Bill Owens: > >> On Fri, Feb 03, 2012 at 01:55:12PM +0000, Florian Weimer wrote: >>> These nameservers: >>> >>> dns2.oppedahl.com. 172800 IN A 208.109.255.50 >>> dns1.oppedahl.com. 172800 IN A 216.69.185.50 >>> >>> return SERVFAIL for EDNS0 queries. COM contains a signed delegation. >>> This configuration is not supported. It seems that BIND produces >>> a failure even if DNSSEC validation is not enabled for the view. >> >> How odd. . . it doesn't look that way from here: >> >> [littledebian:~] owens% dig oppedahl.com soa +norec +edns=0 @216.69.185.50 > > The exact same command line results in SERVFAIL for me.
It depends on the source IP address. I tested from about a dozen source addresses. There is a pattern (most of the time, one address works, but the neighboring ones do not), but it it's not completely obvious. It could be the result of DDoS mitigation gone wild, or per-source load sharing redirecting part of the traffic to a broken instance. -- Florian Weimer <fwei...@bfk.de> BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstraße 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
