dnssec-analyzer.verisignlabs.com aaaa lookup fail

[Walter H.]

On 27.04.2024 16:54, Lee wrote:
> On Sat, Apr 27, 2024 at 9:50 AM Walter H. via bind-users
> <bind-users at lists.isc.org> wrote:
>> # host dnssec-analyzer.verisignlabs.com
>> dnssec-analyzer.verisignlabs.com is an alias for
>> dnssec-analyzer-gslb.verisignlabs.com.
>> dnssec-analyzer-gslb.verisignlabs.com has address 209.131.158.42
>>
> Right, the IPv4 address lookup works.  Now try looking up the IPv6 address.

if there was one it would be presented there

see here for full answer

# host one.one.one.one
one.one.one.one has address 1.1.1.1
one.one.one.one has address 1.0.0.1
one.one.one.one has IPv6 address 2606:4700:4700::1001
one.one.one.one has IPv6 address 2606:4700:4700::1111

>
> I get a status: SERVFAIL instead of a status: NOERROR
>
> $ dig dnssec-analyzer.verisignlabs.com aaaa
>
> ; <<>> DiG 9.16.48-Debian <<>> dnssec-analyzer.verisignlabs.com aaaa
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 60491
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
>
> Lee

this can't be a matter of DNSSEC, as there are only signed whole zones 
and not just single DNS-records ...

would it be a problem with just this DNS zone, why are only problems 
getting the IPv6?


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3550 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240428/b436a5ac/attachment.p7s>