Servfail on Bind -9.16.1
Mark Andrews
marka at isc.org
Mon Nov 23 03:34:41 UTC 2020
> On 23 Nov 2020, at 13:37, upen <upendra.gandhi at gmail.com> wrote:
>
> Hi Mark and everyone,
>
> Thank you for continuing to help me.
> I have set DNS validation to auto from no and restarted the bind9 service.
>
> # egrep dnssec-validation /etc/bind/named.conf.options
> dnssec-validation auto;
>
> #dig +dnssec +cd dnskey .
> ; <<>> DiG 9.16.1-Ubuntu <<>> +dnssec +cd dnskey .
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30138
> ;; flags: qr rd ra ad cd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ; COOKIE: 4c28af06251e4b51010000005fbb1b1fa619c694e6bff1b4 (good)
> ;; QUESTION SECTION:
> ;. IN DNSKEY
>
> ;; ANSWER SECTION:
> . 172780 IN DNSKEY 256 3 8 AwEAAfC/6HLClwss6h7rPfoG2cliv4/SPJRd2HPEglRsvKZRbPP2RLfi obeAkczcdqaD5q8loEt14lcTgDqwzOISZ3YvSVkM4JRMFwKzcjukKo5C sDVbMmhTD0C0yxWICRQ1M+Y5/XkZAT7mt4cb3fWcN9xgyq1wEXQX+zdL QHrNEVQSiL5SoA5cOtCSoQ45n8bKDXdw/0jjP9Rw1FVKsdzLVkQSrVMm 8k30WUkHm/SK/n/954KENkdQOA6Li2vO9nicQdegyAkDeNJCdPN/p3jE hCTQLyO4AlAmyaPcDHeeo7OXr/VsYu4NTDde9hBuS0zx/rewD+BvSnmn NHNmH2FjUE8=
> . 172780 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN R1AkUTV74bU=
> . 172780 IN RRSIG DNSKEY 8 0 172800 20201211000000 20201120000000 20326 . eD2ohirt98vCTbuBKIH8lmGum8g2zumyXA89A999extXqsWmomgVQhcb l6zvJHLdFvhBmA+ZqhOTiXvdXpOPeyqHLuMiRv8TTawNU305WPnsonSx uD5ThT9q7YXUZc9ty19Aur3AU0KtlNGULI+4ExrghEkdTNrysqgDWBO6 zslPuJlzSwu/qZcPWYVjsWRnCtJ9DyCpgLnjSYIUzA0Xz+FWtj1jM0BK Z9EyO+W5EaGkL2/u+bWWG07ZKJN0NwvTuq7Ounc+lz0zZDh83r/H4KRN J4VIoY3qPDkW4ZvGdAFM5o8sZdTTWKbieqCqWccj8W6sHEdiZ91JCt/G 3/FVsw==
>
> ;; Query time: 0 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Sun Nov 22 20:14:55 CST 2020
> ;; MSG SIZE rcvd: 893
so it looks like you are correctly able to validate the root’s DNSKEY records (‘ad’ is set in flags).
Next look at the next delegation to COM. The DS record for COM should look like this
[beetle:bin/tests/system] marka% dig DS com +dnssec
;; BADCOOKIE, retrying.
; <<>> DiG 9.15.4 <<>> DS com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4356
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 5b7d57a994cac977010000005fbb2bcb06affb16b27b98ff (good)
;; QUESTION SECTION:
;com. IN DS
;; ANSWER SECTION:
com. 33649 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com. 33649 IN RRSIG DS 8 1 86400 20201205050000 20201122040000 26116 . lYnjXIlENOzhY5t94JrTnNjkRxfaIvfhfwrxC4KQbVgGIbqfxRqjGlIu 8JIHQaKoIfxXqP93MNhkKvFhOK3t/hYGvQEND/A7x+ktC+0uQFvF0CvE p3qRwQ0HuwR8OSXyS07AjZWTjSUXKqI8/bctkx7CegJtn8uk872tdqEF dnWZT6Tvqtt2NrveR5baSdHybrmoftbCDxndfRKOv/pjcpe0Qy7EDXWQ YL4I9qPtA5+GdxUWvBTWDXCrYKWxfoj6S5L+kPproaiGCABq7XalJIt8 RdbBCkCANipsmBXAv61vy3BEyuJEjQqFxzi+MleJfxRSkaljIXd8A/d4 UM7sRg==
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 23 14:26:03 AEDT 2020
;; MSG SIZE rcvd: 395
[beetle:bin/tests/system] marka%
and the DNSKEY records for COM should look like this
[beetle:bin/tests/system] marka% dig DNSKEY com +dnssec
;; BADCOOKIE, retrying.
; <<>> DiG 9.15.4 <<>> DNSKEY com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25522
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 3ebc796c874b8ce9010000005fbb2c17cd6a9d9d8b8a5977 (good)
;; QUESTION SECTION:
;com. IN DNSKEY
;; ANSWER SECTION:
com. 33656 IN DNSKEY 256 3 8 AwEAAadfNlrLwDe1W0klTRoNDeeEfZAop76YMUvOtl2pu0lXE5Fzj1sD ROflxnOGTI9RfwrA0rD0ixBkW32Pu1nheytLBrPZ32hva+iY8jYQ/TPi Msbc/soa8KHQ77eaJtJAImc+VLuXrI1QmRyrywJWU1fkZ9GyPP5YAhgn ttH6ZDXgMeJYjzs5CLfMiV9vAWFgJvy98bG97JP3PpHL9/8BTGM=
com. 33656 IN DNSKEY 257 3 8 AQPDzldNmMvZFX4NcNJ0uEnKDg7tmv/F3MyQR0lpBmVcNcsIszxNFxsB fKNW9JYCYqpik8366LE7VbIcNRzfp2h9OO8HRl+H+E08zauK8k7evWEm u/6od+2boggPoiEfGNyvNPaSI7FOIroDsnw/taggzHRX1Z7SOiOiPWPN IwSUyWOZ79VmcQ1GLkC6NlYvG3HwYmynQv6oFwGv/KELSw7ZSdrbTQ0H XvZbqMUI7BaMskmvgm1G7oKZ1YiF7O9ioVNc0+7ASbqmZN7Z98EGU/Qh 2K/BgUe8Hs0XVcdPKrtyYnoQHd2ynKPcMMlTEih2/2HDHjRPJ2aywIpK Nnv4oPo/
com. 33656 IN RRSIG DNSKEY 8 1 86400 20201206192421 20201121191921 30909 com. K3w8cixeKqKbELJMyFynhuA+1oQYbLNSZhZ1NcSofx+ND3ImYoQ4rodY uZokFmKvJkZvrBMSF0tfwWLYbyX+Xw2Fb//KKDD6gluN/evmoH3xv/XC j4WFRUwF1L5jPjeylY233GzQN2RVHDFFpsdczcGwNp2BqyBMXHe2Lv+1 kOeTfEoA/XJdZSEMlo3V0xq6sxB9747wRfHm17ockLIHtWMI8eSyIO92 nTQj2WZninySf6N8yb5tGUu0ABoXlVF6fc9INybFNTZg7gF85hfCtjK4 Ko6W97d1CW5AyvGprYtJgNQDqzqoP7qkvFI4oSRDZJITwamhci90hBMv cXZDWA==
;; Query time: 6 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 23 14:27:19 AEDT 2020
;; MSG SIZE rcvd: 805
[beetle:bin/tests/system] marka%
and as facebook.com is not signed you should be able to get a negative response like this
[beetle:bin/tests/system] marka% dig DS facebook.com +dnssec
;; BADCOOKIE, retrying.
; <<>> DiG 9.15.4 <<>> DS facebook.com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28221
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 8502baa6ff39d4e6010000005fbb2c54d8973480d1f10428 (good)
;; QUESTION SECTION:
;facebook.com. IN DS
;; AUTHORITY SECTION:
com. 900 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1606102077 1800 900 604800 86400
com. 900 IN RRSIG SOA 8 1 900 20201130032757 20201123021757 31510 com. cwoLEgQQ8YIPJi62EkW5J7qqTJuA/uOc477ST6Iy45DstUYd4rj6ecGK fJHIku27I2EBXqacjgi3oE7DxFKWYvxsr3mvata1bCdcGEa1tv3RS9/E huSaFE4ZNTSWRU8RNRpkqauWpyQRDve2hUkVTARNcHWYEFxrMEz6dL5q V5qCzI+h0CiWmo249Akbqn2sIhbgmSqolkkrXd7C936r1w==
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 900 IN RRSIG NSEC3 8 2 86400 20201129054027 20201122043027 31510 com. kZw7h9mbKgXQ2YhIp+jKmg5xOUmZq7HPGRTZ2ERwIA5FjOBIkEWqWHga SZhV/78SqH26QbwCXQnf0Hv7xzMdVwYOr7FwDE+7a//cL8yRe5pBd5Bb y1QORmqRT8kTshhedhwyxjzk4TxcN8M0/JqiDUhb6iHacDFqqwIhm13l Wy0xjM5nojLmY/fYuH/mKSsz5XlfEKGqG5q1FbZUZWhj3Q==
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 900 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
I28FT380NFMJ3TJ970NBAD0HSSK1LEOK.com. 900 IN RRSIG NSEC3 8 2 86400 20201127071904 20201120060904 31510 com. VuV00I8jZMAbQmVLBub0Yfk5eEng8NkCFrPCvK/19YpzEzkWKPpOVcya xZqYZzAVBhSP/n2/kcC8tkDMFZHL8rbGAg/jPpJCAhp2Tszhc8pzqKtZ CmFMZtO8HQGx1ZjCGpzHZ+6/5irvE7NJrkndTmoOd/1RfS/WeZseAkCb 204Td7fE0C5D/8oGRb81vFICH2IjnykeoEguPvWLXnWfqw==
I28FT380NFMJ3TJ970NBAD0HSSK1LEOK.com. 900 IN NSEC3 1 1 0 - I28GLTLV5D2H16BES4T7GHH4AABNFOB0 NS DS RRSIG
;; Query time: 99 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 23 14:28:20 AEDT 2020
;; MSG SIZE rcvd: 889
> The root zone is not forwarded and the file is located at
> #ls -al /usr/share/dns/root.hints*
> -rw-r--r-- 1 root root 3311 May 29 2019 /usr/share/dns/root.hints
> -rw-r--r-- 1 root root 72 May 29 2019 /usr/share/dns/root.hints.sig
>
> Contents of the root.hints file are pasted at https://dpaste.com/EWKCX34NQ . File is provided with OS package -> dns-root-data (Description: 2019052802 DNS root data including root zone and DNSSEC key)
>
> Additional files provided by that package
> #dpkg-query -L dns-root-data
> /.
> /usr
> /usr/share
> /usr/share/dns
> /usr/share/dns/root.ds
> /usr/share/dns/root.hints
> /usr/share/dns/root.hints.sig
> /usr/share/dns/root.key
> /usr/share/doc
> /usr/share/doc/dns-root-data
> /usr/share/doc/dns-root-data/changelog.gz
> /usr/share/doc/dns-root-data/copyright
>
> Not sure what changed here, I am getting results now even after the "dnssec-validation" set to auto. Really puzzled
>
> #dig @127.0.0.1 +dnssec +cd dnskey www.facebook.com
>
> ; <<>> DiG 9.16.1-Ubuntu <<>> @127.0.0.1 +dnssec +cd dnskey www.facebook.com
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19781
> ;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ; COOKIE: 028fb4fde9f61d53010000005fbb1fcca2b3cd29887d7e13 (good)
> ;; QUESTION SECTION:
> ;www.facebook.com. IN DNSKEY
>
> ;; ANSWER SECTION:
> www.facebook.com. 2395 IN CNAME star-mini.c10r.facebook.com.
>
> ;; AUTHORITY SECTION:
> c10r.facebook.com. 216 IN SOA a.ns.c10r.facebook.com. dns.facebook.com. 1606098709 300 600 600 300
>
> ;; Query time: 0 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Sun Nov 22 20:34:52 CST 2020
> ;; MSG SIZE rcvd: 176
>
>
> Thank you,
> Upen
>
>
>
>
> On Sun, Nov 22, 2020 at 5:47 PM Mark Andrews <marka at isc.org> wrote:
> Ok. Lets start by debugging this from the trust anchor downwards.
> Lets see what "dig +dnssec +cd dnskey .” returns. It should return
> something like below with 2 DNSKEY records and a RRSIG for the DNSKEY.
> The RRSIG is regenerated daily so it will likely differ. The DNSKEY
> records should be a exact match. In this case flags contains ‘ad’ which
> means that the RRset has previously been validated.
>
> [beetle:~/git/bind9] marka% dig +dnssec +cd dnskey .
> ;; BADCOOKIE, retrying.
>
> ; <<>> DiG 9.15.4 <<>> +dnssec +cd dnskey .
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12403
> ;; flags: qr rd ra ad cd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ; COOKIE: f182281b307ab59a010000005fbaf21fcdc7ab7803361e3c (good)
> ;; QUESTION SECTION:
> ;. IN DNSKEY
>
> ;; ANSWER SECTION:
> . 134751 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN R1AkUTV74bU=
> . 134751 IN DNSKEY 256 3 8 AwEAAfC/6HLClwss6h7rPfoG2cliv4/SPJRd2HPEglRsvKZRbPP2RLfi obeAkczcdqaD5q8loEt14lcTgDqwzOISZ3YvSVkM4JRMFwKzcjukKo5C sDVbMmhTD0C0yxWICRQ1M+Y5/XkZAT7mt4cb3fWcN9xgyq1wEXQX+zdL QHrNEVQSiL5SoA5cOtCSoQ45n8bKDXdw/0jjP9Rw1FVKsdzLVkQSrVMm 8k30WUkHm/SK/n/954KENkdQOA6Li2vO9nicQdegyAkDeNJCdPN/p3jE hCTQLyO4AlAmyaPcDHeeo7OXr/VsYu4NTDde9hBuS0zx/rewD+BvSnmn NHNmH2FjUE8=
> . 134751 IN RRSIG DNSKEY 8 0 172800 20201211000000 20201120000000 20326 . eD2ohirt98vCTbuBKIH8lmGum8g2zumyXA89A999extXqsWmomgVQhcb l6zvJHLdFvhBmA+ZqhOTiXvdXpOPeyqHLuMiRv8TTawNU305WPnsonSx uD5ThT9q7YXUZc9ty19Aur3AU0KtlNGULI+4ExrghEkdTNrysqgDWBO6 zslPuJlzSwu/qZcPWYVjsWRnCtJ9DyCpgLnjSYIUzA0Xz+FWtj1jM0BK Z9EyO+W5EaGkL2/u+bWWG07ZKJN0NwvTuq7Ounc+lz0zZDh83r/H4KRN J4VIoY3qPDkW4ZvGdAFM5o8sZdTTWKbieqCqWccj8W6sHEdiZ91JCt/G 3/FVsw==
>
> ;; Query time: 0 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Mon Nov 23 10:19:59 AEDT 2020
> ;; MSG SIZE rcvd: 893
>
> [beetle:~/git/bind9] marka%
>
> If you don’t get answer like this then we need to work out why.
>
> Do you have a local copy of the root zone? If so is from IANA
> or from somewhere else?
>
> Are you forwarding the root zone? If so what do ALL the forwarders
> return for "dig +dnssec +cd dnskey . @<server>” where <server> is
> replace by the IP address for each server. If you are forwarding is
> is forward “first” or “only”?
>
> Mark
>
> > On 22 Nov 2020, at 08:20, upen <upendra.gandhi at gmail.com> wrote:
> >
> > Hello Ananad, and all,
> >
> > >www.facebook.com
> > $ dig @127.0.0.1 -t A www.facebook.com
> >
> > ; <<>> DiG 9.16.1-Ubuntu <<>> @127.0.0.1 -t A www.facebook.com
> > ; (1 server found)
> > ;; global options: +cmd
> > ;; Got answer:
> > ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 38917
> > ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> >
> > ;; OPT PSEUDOSECTION:
> > ; EDNS: version: 0, flags:; udp: 4096
> > ; COOKIE: a18d9ed2a6d1bcd6010000005fb982763dfdafed174d4ef1 (good)
> > ;; QUESTION SECTION:
> > ;www.facebook.com. IN A
> >
> > ;; Query time: 4 msec
> > ;; SERVER: 127.0.0.1#53(127.0.0.1)
> > ;; WHEN: Sat Nov 21 15:11:18 CST 2020
> > ;; MSG SIZE rcvd: 73
> >
> > > Your instance of BIND is probably logging to syslog. Look for these logs
> > > (usually /var/log/messages), and see what BIND is logging. It may shed a
> > > light on the problem.
> >
> > Thank you. I enabled logging and when I grep for www.facebook.com , I notice the following output from four different log files named.
> >
> > debug.log:21-Nov-2020 15:11:18.004 queries: info: client @0x7fb6a800c0a0 127.0.0.1#33706 (www.facebook.com): query: www.facebook.com IN A +E(0)K (127.0.0.1)
> > default.log:21-Nov-2020 15:11:18.008 client @0x7fb6a800c0a0 127.0.0.1#33706 (www.facebook.com): query failed (broken trust chain) for www.facebook.com/IN/A at query.c:6883
> > dnssec.log:21-Nov-2020 15:11:18.008 validating www.facebook.com/CNAME: bad cache hit (com/DS)
> > lame-servers.log:21-Nov-2020 15:11:18.008 broken trust chain resolving 'www.facebook.com/A/IN': 129.134.31.12#53
> >
> >
> > Before running this query I also added dnssec-validation auto; to the options file and restarted the bind9 service. It's pointing to a broken trust chain which I am unsure how to resolve.
> >
> > Thanks,
> > Upen
> >
> >
> > On Sat, Nov 21, 2020 at 3:11 PM Anand Buddhdev <anandb at ripe.net> wrote:
> > On 21/11/2020 21:53, upen wrote:
> >
> > Hi Upen,
> >
> > > Could you someone guide me to troubleshoot this further? Thank you for the
> > > list.
> >
> > Your instance of BIND is probably logging to syslog. Look for these logs
> > (usually /var/log/messages), and see what BIND is logging. It may shed a
> > light on the problem.
> >
> > Regards,
> > Anand
> > _______________________________________________
> > Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> >
> > ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
> >
> >
> > bind-users mailing list
> > bind-users at lists.isc.org
> > https://lists.isc.org/mailman/listinfo/bind-users
> >
> >
> > --
> > upen,
> > emerge -uD life (Upgrade Life with dependencies)
> > _______________________________________________
> > Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> >
> > ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
> >
> >
> > bind-users mailing list
> > bind-users at lists.isc.org
> > https://lists.isc.org/mailman/listinfo/bind-users
>
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742 INTERNET: marka at isc.org
>
>
>
> --
> upen,
> emerge -uD life (Upgrade Life with dependencies)
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: marka at isc.org
More information about the bind-users
mailing list