On Fri, Oct 06, 2023 at 01:36:26PM -0700, Craig Leres wrote:
> > So long as you don't try to look up TLSA records, or insist on using
> > EDNS(0), even after a FORMERR response, you should be fine.
>
> I've had edns0 in resolv.conf for a really long time but even if I comment
> that out I'm still unable to deliver mail. Also I get SERVFAIL or a timeout
> if I lookup outlook-com.olc.protection.outlook.com.
It is your resolv.conf's EDNS(0) setting that matters. That's just
between your stub resolver library and your local "unbound" resolver.
What would matter is whether your **unbound** resolver is willing to
fall back from EDNS(0) to legacy DNS.
However, I was thinking of the "mail.protection.outlook.com" zone,
handling customer domains. The nameservers handling Microsoft's
own "outlook.com" domain seem to handle EDNS(0) just fine:
- protection.outlook.com. IN NS ns1-gtm.glbdns.o365filtering.com.
protection.outlook.com. IN NS ns2-gtm.glbdns.o365filtering.com.
$ dig @ns2-gtm.glbdns.o365filtering.com -t a +ignore +norecur +nocmd
+bufsize=1400 outlook-com.olc.protection.outlook.com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16548
;; flags: qr aa ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;outlook-com.olc.protection.outlook.com. IN A
;; ANSWER SECTION:
outlook-com.olc.protection.outlook.com. 30 IN A 104.47.11.225
outlook-com.olc.protection.outlook.com. 30 IN A 104.47.11.97
;; Query time: 76 msec
;; SERVER: 104.47.40.8#53(ns2-gtm.glbdns.o365filtering.com) (UDP)
;; WHEN: Sat Oct 07 02:04:43 EDT 2023
;; MSG SIZE rcvd: 99
In contrast with, e.g., the nameservers for the "nist.gov" MX host:
- mail.protection.outlook.com. IN NS ns1-proddns.glbdns.o365filtering.com.
mail.protection.outlook.com. IN NS ns2-proddns.glbdns.o365filtering.com.
$ dig @ns2-proddns.glbdns.o365filtering.com. -t a +ignore +norecur +nocmd
+bufsize=1400 nist-gov.mail.protection.outlook.com.
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 20587
;; flags: qr; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: EDNS query returned status FORMERR - retry with '+noedns'
;; Query time: 51 msec
;; SERVER: 104.47.68.17#53(ns2-proddns.glbdns.o365filtering.com.) (UDP)
;; WHEN: Sat Oct 07 02:09:06 EDT 2023
;; MSG SIZE rcvd: 12
So whatever the problem is, it is perhaps not EDNS(0). And specific to
your network. DNSViz also gets adequate results:
https://dnsviz.net/d/outlook-com.olc.protection.outlook.com/ZSCCwA/dnssec/
--
Viktor.
_______________________________________________
dns-operations mailing list
dns-operations@lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
