DNSSEC server failure with trstech.net

[Gilles Massen]

Stéphane,

On Thursday 06 November 2008 14:01, you wrote:
> dig MX trstech.net
>
> makes a SERVFAIL. (The BIND resolver is set to dnssec-validation yes
> and uses the ISC DLV registry).

That seems to be the issue: trstech.net has an DLV entry. It kind of 
illustrates that once you've gone the dnssec path, it hard to go back 
again...

dig trstech.net.dlv.isc.org dlv

; <<>> DiG 9.5.1b2 <<>> trstech.net.dlv.isc.org dlv
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31776
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 5, ADDITIONAL: 6

;; QUESTION SECTION:
;trstech.net.dlv.isc.org.       IN      DLV

;; ANSWER SECTION:
trstech.net.dlv.isc.org. 3600   IN      DLV     36472 5 2 
FB0DA57E6C06EA0CF636C47016DCE1DAC81142A3FCA389D2CBA829FC 2E0EABE0
trstech.net.dlv.isc.org. 3600   IN      DLV     36472 5 1 
0B4B9F5A6CA4B0C800D2B432F1D206F176E8E00F
[...]

Gilles

-- 
Fondation RESTENA - DNS-LU
6, rue Coudenhove-Kalergi
L-1359 Luxembourg
tel: (+352) 424409
fax: (+352) 422473