SERVFAIL when looking up TXT from particular domain

Thu Jun 27 01:47:21 UTC 2019

Given the message says "ran out of space” it indicates that a fixed buffer was
too small.  The lookup also works with current versions of BIND so I would
say the solution is to stop running EoL’d software and upgrade.

There is also a ridiculous number of DNSKEYs and signatures. I suspect that
the operators are forgetting to remove old keys at the end of the ZSK key
roll.  Eventually, if they keep this up, they will exceed the DNS/TCP message size
limits at which point all lookups will fail.  At the moment almost all lookups
from DNSSEC aware resolvers are being retried using TCP as the UDP response is
bigger that almost all EDNS UDP buffers sizes in use.

Mark

% dig dnskey capgeminioutsourcing.nl +dnssec
;; BADCOOKIE, retrying.
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.15.1+hotspot+add-prefetch+marka <<>> dnskey capgeminioutsourcing.nl +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32208
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 32, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 2a6e6fd5aa9f72ee316bd1b35d141cead6bdc8ea9ffcc457 (good)
;; QUESTION SECTION:
;capgeminioutsourcing.nl.	IN	DNSKEY

;; ANSWER SECTION:
capgeminioutsourcing.nl. 171829	IN	DNSKEY	257 3 5 AwEAAdl6guTPSdcNju0yBB1Co9aK6eTZRBHVIS6r8jzaLwdbqz29/8SX wUJYpQTZkl6ymhJJoGNCuTetGBBinSw3syJHg+8rKN8zure+q/3l1XdF BqRpgV6C2Gwznxx/T28HcQhh14LvPTfV0KTO3UDF+Ajn4VbpxdHAqKdk hbL3hhzWPAxEvUtafWn4ciKtuwlPesIO45SMFwgS2q3sh62D3Fqcddsl S9se15IbziJxwYjrY+EsMVuEr0TQw6awv3vuiPQv9aYxQ54ofG51eeoO YpvcYn6BN0JTtfpCkBIu3mp74IkzJ5w4Tlxh37D5bqZuOKV+IuFsmURa x1AP9xynygM=
capgeminioutsourcing.nl. 171829	IN	DNSKEY	257 3 5 AwEAAZri/HxDrwsM6/WwdiIvQ6o3ejG/uPr7xvYxWcFipjo2rDHPdTO8 ogvwsxPa0/nNKzjUzFcfMfdP1dScXUgL6CDajOM8mdcKaOXWyhx4gdCW 9W8rQLIVBVHnWkNZ9LTlgw6lsMvu/NkBFGNh+Y2KV6o2G0rh28Y5s2gh 8aqha2OMQ3td6fDKjSKJwngMC1OdowKMPalliaeXZh4EMZXAaynrtzZ0 rh57pUaiPXk3FssoUBLckWGeUypKEDM/88w+y1/mQiPBLtMS/xEo/ygD X1YtQmvT+7hr/FjlqLKHUTL4Ag4UyTbcwTgV5OYS+DUQONER7bWBRPHT ZV1k8y8oJ/s=
capgeminioutsourcing.nl. 171829	IN	DNSKEY	257 3 5 AwEAAcaIcFtcMdX9gsRSHymm1UhX4FDyzQBN+gSvdZ3zcqJkPVEBeS0l VxAtq+CF5nr5lKwL4m+yx8lMFOJxraJWcCQJRYoSiW6cY/Di/AJQ9Fa3 YwK/443/JfgR785tTwmOGF2ITxIZo68y/Iaa/yxjjO1DlcTO9yycguAm vU/nTxMIx/8710waKOWcDEvdg80EEPJiL/XiR3cH9b+O+VaYSRq9EatF bRPeIjKEaHqJM1600gCgrlxGCzlI574uUJVYPwrDsjSIFuuOR31ZIrp9 7mMDYPi0AO+cSDPUGIIapBVlBf2c6Jt0e8lCWj6JJBpsyaMZlYpxpcQq grxEQ0rXcCc=
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAdX7RZYcX8dYd2A502dN2GouKK7yLhbNcI7qXk0zl4EycG3HgDz+ PgjfLemaPPSOXJ2SfPG1huZuQ3VCTrZoew5UjSdnJkZZrjp7tTe+su9/ 9csHOZMzpmlr4N6v8MxC4ldDWxVXWj5zur+MLzLtahChPQpftceA+HkY 4lQp5TN9
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAZ8RTy1CgiIk7VgjkqfNQJnEzqc1xN8SxZgm/f+V3zRvU+ScB76q BuSsaRhlvDbmctJ4x1QaPa/3Xo5ws7Gt80zw8LQtjh//d5gCF8BImzmq JLAlZ5osad7HS6/d+oDKh/kOB92h1dPjh0QOATdC4a4z3DVo6v7eodwb Lg4eaevN
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAdoG2gQ/uE4m+1Kk2A1Rae4d3Fyz75ru2qmfVDNc7MYOPIwsMuJo GxJ+cCEuI5jNyiOgLZmDX87Deuj5bW1pUleNzbZegUB77C4ho+r2JAM1 7SM8jMemQAMHR7OWfgmJvxTGlD0OLObgMtHj1zkaIleqBIUxQVYIC/Bp lAVPSCzt
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAb7deXB4jJ8LP9SyoDIQgMIb06QHeCV7wODVLMvQIBKYIoyE0Z2M CkFp/aPDGgwQY65ZQm9g9SgHT+KBHVsguGfY6JxVus3lUXewJHtwqz9S bZRfu/P13mW4s/3BAdA4a+5QktNTvUapp9ROc2L/56bEhGDSAloGFo4P B8Wd92rx
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAdQTk0UbPeC366qpj0/KhyH0xnJ0o8BLuggBw0tvtcbh/Dm62fpy tlu8jzhQ1BxElYbt0jT4zceur+qObH1gJt6b+hnxyY2yJ+MjTI0p9bUM UMp+n66mT3Kqj3KBOUBgXPSU2sSRHpSXgmcQcNvNy7/FWwMtD0aErX1M FfKGMAKN
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAb/ahg1GVqXy97t5W+RI16XCu8/Jf1QfhE/oe2EQV6C2VOsrmcSK Fp6COdVcCIaYv3gNQs59lG737JnbopiJik4YlcxBgFZ61wkzuM87a3ab 6ta1QVXxPixqMdP9hUiSNcr7f27eeW57kgjwmfFAwLhvx3lUtFNwlqCs KUA2xcaX
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAbxHYQ92nWwB48WdeuL12RtyHUi5/g6Ukn/Gvegp5gxF+XjkOdHs pBykxKf+PgNzenEJJNppdAOPlwGVgDNzvX63NjLF/3juVKLD2KzTxBm9 4JJeaE0FnGmTyhAfklVK0GkseomuSkBdnWEyLwZm5FKZLAdARuwci8dM 4ir78gPF
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAdzVD6HLAePyWKbnLZaaQO3xI4KPJGbjmuw62GiU7YiPpE+bWI68 nrAbW6iWQvxQJIDSY0akLRV12U3rhJfsWVdG1Qmt/XA5tKet7VaUyFmL woLE0a9jkyG8T7S3go5oa9wvDtAfvDNS0KJstPZGAtYRYKv5E5l+9oNI w19ObRZZ
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAZ5M8n3CSSK4zlwy7RJGbmeSDdIqrRV086TWjLw8hvf8mX2mBEiy P6K5qvLrAmAgffzu1PboiRo+QjZDXL4qruV1Sf/8jPFaGEkrjosgRtZn APG/ivSux07e/34BJa8BBKbjIt64KOJnzlh27WSghHzwhto+8KW2EAf2 E6qDiY6J
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAe9cpo9TeXC1XNsLmqStFRVK8tg3kJJQW3AQpY8RbQNsbPviMtgF 6kWewilV8D++XQ7eMqpQrYCjw7yLT4oMSHNVs6Nks+1wa9+Yf9n3qw8s v/PzqJbQW72e97aZ9/WPMNnMjq668jnCqkyIsOt57tz7NInGF4gOuRLM MZeQnCEJ
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAdu3396Y+5EubdEIMHUuBFy7ibNlj/G7GJ8n49wCftc3PweIWrgW aZmYO8yfZ8XtLPrqtFlS8EQhn5zO/iJFHVW384NSTBNi4rTNylv0Hh1P NNP2JtaTtNgXwAJTH0t9eXkAI22A6YUqZshV6TnS27h7K0OJmWg952Yy AHzXpCnr
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAZ/HeV1xDkHcR3q3svuKErOLixNkQ1NST/6Av7KUBMhW+sVB5jKD zNVffgXMLA64U1tjliM7e6zPRWPUg9b1b2DiFikkrqBE9ytn2yWGYu/r 4A2aY9UIhBM1l4clZ59XjA2FURsg1Fx/atpuxnaES0Z1hRvPiFATAGmA 3VPgUnDf
capgeminioutsourcing.nl. 171829	IN	DNSKEY	256 3 5 AwEAAdHd/PYp4YEA6eexFtVAULn80DBHTUXWJK8gjslVWc6lGum3P+NL J4Jd5ke/O4I2oEMrSUwDblpPDI2oH2tHzngAmUMM9C8X0QH78YMUjMs3 OVdwHArXyCcWHROYdjbnAG+eeAMcaWDuP5p/AGvBdu0oqPOi9kHCsPA9 Wrwcep+9
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 3378 capgeminioutsourcing.nl. HLDhnBLs/I/YS69xgcnuNuMAVXtkr0hA61UcgBxwnpI6q3dbY68oR+LX rjt/0vKyRuFca56z0GHAguJAlDfJzXs/SwR09akpEY32yuXzjsC5SC7j 6CjHPMSKRyv7UliWPDiVExPZhDs+eIldt/g4RL1R4vTNJkkBiW1Z5mw2 vKw=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 13062 capgeminioutsourcing.nl. qOvnyNuKSKiP3HjEsYg2lYAp76k1T5Z+49yUNaBsJPZ53ZEIF0yuO87V GxoiEuOcvsrxuSy8iEmK7SCSJ/Vpug9kfb92h4j7ykW8r+zZ/9QjpTWy gsjj3nreplrEUzkyG4h4CHCNE79OfxKXTFjUrSWh53PHMtbBuHO1fIww vuM=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 15507 capgeminioutsourcing.nl. riP1pFdA76ysIt2+yCxH1ShVUEcRc/QoZhWm0aAntSlbv4luc3cAfGQq ZWuhsygerHZf7750vUY45zBKmSFdn85aM+5qGHdJXnJ7h3mmaI1MsECX Iq1nMLPi5uyeTbjiRwPUP+0yBCdzrzT6+ixsB9C1d4QXVm0+e/vaMJpR 42g=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 18372 capgeminioutsourcing.nl. c6w3t0RE0sNr6VFH0Ipbnp0sTHNt8xEPiZwYKeOC6Ood0icmJc9xGtEh CI5ymGHERktOdhbpYXJo3UpMOJr/YCj0hrnYJHUjREDiCodVgl0mqoX4 fTf/E/VsDr3ZlmSWz6MMF+knqrXMBDcCeMbnLxh0A/ia4zoGhOlHBv2f kNA=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 31287 capgeminioutsourcing.nl. QZoAGBB9nvW4LvADqPfreShwymwMuKpK6SzacDOW4r4a6W6MIbJ1b7HI 7nzL8cc/pB5ZKBUX/R54IVAM9h5aMoAbj92eCinN2KlDIaiP3TpuhU0J nkgufLL+f02qPHLsEzA+DX511Ndo6ad2z4eH/p1rpVIM01VZzqujLlXe lO8=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 33000 capgeminioutsourcing.nl. VUskNBlWN08U3vZGrol2XIgYle+nwARYH42fX6+OTo3D7Le+e82T+nP5 9lQvuONG5rD/4gynT8VPXCOq5aMqs1XmrKOO9zp6Q04kQNJDnnSXKT52 FVaaNnhsZG3FQyt6ReC1tRr/tysOZJWU6B+qQ+DZYurnC9g9vWKpPl40 w8g=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 39915 capgeminioutsourcing.nl. GZVf6sGG7eYyZ00hRQ3fYsADBEgXtH6ubDhFxA52oc18PcyFNgKUikY1 TUca3+0U8vHREukBpKg1XoNxO/lPkpL3gKjyUWTm2JU1w2bFd+vWVx6B shBuS4lheFUXr9dzF/G4lBEPUCTrLZv337Ps6kz0RT4uXG4EGCe5gAk+ zkw=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 41178 capgeminioutsourcing.nl. d/Y2ADxjv7Lnd5UAHd704WzpQDXduILydo/adyImPCIzHER+gS0tWtDQ njWnQvWwaIkV5OTBoycreKTR4aw9zCh61AjaPP2S54erVrfQOu7NtbCA +QIEgABO2VvZN8kmP98Sa8eUakdVHe36Ws8dIVfj3Xd1Fz/c+QoI6kK7 jVo=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 42630 capgeminioutsourcing.nl. P1noL3Qadi0JIWZK+tPYghhronFO+1B1TIzrz0PIhAxKwqrbehQ03t4h fY1ESyls8M4d0CMIQacVz3PheUyq0trYHFSKcvbKSZwHIVrXGyYTLHMW KxfOBtaNaXk3GqTQsiiPOceYg7425RAdEIflaZduBi60E1YRph+sG72B HZM=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 44806 capgeminioutsourcing.nl. MxPSu8gtPN/9dQY3VjEPE0jWxBYfujPolcNx4C/Lw5SLZPSymgNiRmqX EsDzbi5gmv8Pfx5EqX8AVlmPEEJsHa/l2qWk63ETLRhIZIL86qs/Z7+3 2KWxRLwQwWUOVCWmepvYCU1LjOHK+ua8nw/5CtT0BHkVAWttsYOca/A9 +D9FACR8KipLF3gZfJWsDDeTFIdQwIcbgdIDJ5fN3rnag/cig9jQH3OA IeezEYRMyYjIFT8631wbQRrZVJ7gZsxBnnP6ZrhZjt3blU7ws4KQ9p1x oDDarwHZzvsCF0KtN6DfqjDaWtxIFdGvpNOboXJ5oCWyBTcfKEISb0Rs u01Ezw==
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 51837 capgeminioutsourcing.nl. vTn3i4ZNPZyo5EdSsB6s+1qG9zu548GvO/PBpYHm5kQiAnxM78vKNkap V76uRLG+6/kNMBeUjM/EXaMAnCE1esevWn2pvYabfaB8L7F82bpWfnuJ jE6VRxS8YlZNJTyMiVEwjV8Dpve/idlO//mbH+ZB5NGrRohKUvEx0DAL mj0=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 53331 capgeminioutsourcing.nl. Kp7g8ydX15lqC8ZPGmLJN2J+dvVIiQjuphADy1fh4kfQXZeVUJOq9iMx uU7W2aoPUm4xrOk4VdQ9Rs37uNIs50bXIsZg3jvyK8rkt2ePWVG47yIc wUhM3m/bFGTdLo9CGfF8+mdWKQoc8VUjFIsInQQ0M6zNQb9FvSpHzEFO rwI=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 54871 capgeminioutsourcing.nl. r8rWPks3bNY7v6azDPqVV8xna14+MobD9JmW4YL7pOxPetnq+PxHudlO fU7VSqRocoxlg3fG4X4Rk95mywWovpY7v+8Gq4+Y0OyGDUs1kzLSW65Y zn+2UYOSV1UkAlihHzTdSpDDW9NfAOh6pJJEs1VfegS2WJvcGpsX/cXj ckpuAr2ENWu2nTCnIQ0Q05RQe0Bbm1a9bNL5x+uHliMRBPEQFTXn4rRw bO7SqdbgmBpbi76M/RFgvyLSg0ZU00ngLdKeprT9v4DO0IfCqNssKpW4 iyfirSiNoApSXuo+oRxp3MjwpgXuql+8L/Q57IbvLlfQ5/8OZlm9UmPj rHgZVw==
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 56932 capgeminioutsourcing.nl. HwAtQ5P8Z3HbShg7W4K8ZfACHJHrXQpLzDvtibdXG/+hpcyWLy5xv9Pu hUXOnKNAcc2QbjXs4YpCrUQOtRT67EqUIYw0p+R1+g1Fxd1L0JSz70Kv OztuqTyGQhaBMVpEs/w2QkM2iK5p9RlXYok+UgPZPdOOYA4/zhnohd9Z UAIdko4kxDX3KSrwgOyq5UF9azEjq/K4lkbVzSuCc/U0nZ7VdicVKDrm KgbBACETri8jcAebSEULAVkUTCAzaqb//lSPj2J04VNXTtUfqrbMARJk iqGvpdHV02L8IQGJRSErNQePAEZAaH+181hdnIj4ktsML8yLzV73b0CR eDSNzQ==
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 58758 capgeminioutsourcing.nl. BCxk4MGJg1Bvwji41snx6ZLMF5TxQTRvmX1F5Qu2dLsnHSzg6TbSJpdL /hfDniL9tSL7R9qLoGgKuX9hkqrSvGJjIQ0dU8gVtY69OzZD+3XVl45a a3WWShQNpKr778UrynrJohLiGhg95QRIotYYOKOybEw5jnhQJGRLHwqZ gXE=
capgeminioutsourcing.nl. 171829	IN	RRSIG	DNSKEY 5 2 172800 20190630182146 20190626173350 63123 capgeminioutsourcing.nl. mKEI8A9JjBK5edEfW1kWV6gcRk2yUbezmx3sCFGQceDOIPl8rQoTdcjN HF/qKAFh6FDwD2L/rpMAIv+8SThhtUtKk+ZV7OklVwDksxDYmYNKmF9h h/uWkrTJL4+1eS2VY11B7qQvhs0dsLT1T4VolNI3CzFbqkk5Y3J51JDV GDY=

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jun 27 11:33:30 AEST 2019
;; MSG SIZE  rcvd: 6144

%

> On 27 Jun 2019, at 11:17 am, Carl Byington via bind-users <bind-users at lists.isc.org> wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> On Wed, 2019-06-26 at 13:16 +0000, Dennis via bind-users wrote:
>> dig TXT cleanmail4.capgeminioutsourcing.nl @localhost
> 
> 
> dig TXT cleanmail4.capgeminioutsourcing.nl +nodnssec
> @ns1.capgeminioutsourcing.nl.
> ;; MSG SIZE  rcvd: 124
> 
> 
> dig TXT cleanmail4.capgeminioutsourcing.nl +dnssec
> @ns1.capgeminioutsourcing.nl.
> ;; MSG SIZE  rcvd: 4931
> 
> 
> Check your ability to receive fragmented ip packets.
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (GNU/Linux)
> 
> iEYEAREKAAYFAl0UGRIACgkQL6j7milTFsFh1gCfcny3HFKDxUH8p9bxF6vVeSZm
> 0rIAn3rUK0pCmDeQeStpakHQaldlvoN8
> =cOJV
> -----END PGP SIGNATURE-----
> 
> 
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka at isc.org