DNSSEC error resolving gpo.gov ?

[Darren Ankney]

This is failing for me regularly:

$ dig ns3.gpo.gov +dnssec +norecurse @162.140.15.200
;; communications error to 162.140.15.200#53: timed out
;; communications error to 162.140.15.200#53: timed out
;; communications error to 162.140.15.200#53: timed out

; <<>> DiG 9.18.11 <<>> ns3.gpo.gov +dnssec +norecurse @162.140.15.200
;; global options: +cmd
;; no servers could be reached

but all other combos of ns3.gpo.gov or ns4.gpo.gov and 162.140.15.100
and 162.140.15.200 work fine.

On Tue, Mar 14, 2023 at 12:03 PM Tim Maestas <tmaestas95 at gmail.com> wrote:
>
> I've been having problems resolving www.federalregister.gov which is served by ns3.gpo.gov and ns4.gpo.gov, using BIND 9.16.27.  Haven't been able to quite figure out why so I've stuck an NTA in for the time being.
>
> On Tue, Mar 14, 2023 at 8:52 AM Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:
>>
>> On Tue, Mar 14, 2023 at 11:35:38AM -0400,
>>  Alexandra Yang <drayales at gmail.com> wrote
>>  a message of 183 lines which said:
>>
>> > I wonder if any of your nameserver resolve it just fine, like 8.8.8.8
>> > works
>>
>> Among RIPE Atlas probes, most succeed:
>>
>> % blaeu-resolve --displayvalidation -r 100  --type A gpo.gov
>> [ (Authentic Data flag)  162.140.14.82] : 46 occurrences
>> [162.140.14.82] : 52 occurrences
>> [ERROR: SERVFAIL] : 2 occurrences
>> Test #50935448 done at 2023-03-14T15:46:50Z
>>
>> The two whose resolvers servfail may have stricter/paranoid resolvers.
>>
>>
>> --
>> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
>>
>> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
>>
>>
>> bind-users mailing list
>> bind-users at lists.isc.org
>> https://lists.isc.org/mailman/listinfo/bind-users
>
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
>
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
>
>
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users