dnssec-analyzer.verisignlabs.com aaaa lookup fail

[Walter H.]

|Try these four
|
|
|
|fail01.dnssec.works|
|fail02.dnssec.works|
|fail03.dnssec.works|
|fail04.dnssec.works|

and then with   +cd and note the difference;

On 28.04.2024 08:17, Walter H. via bind-users wrote:
> On 27.04.2024 16:54, Lee wrote:
>> On Sat, Apr 27, 2024 at 9:50 AM Walter H. via bind-users
>> <bind-users at lists.isc.org> wrote:
>>> # host dnssec-analyzer.verisignlabs.com
>>> dnssec-analyzer.verisignlabs.com is an alias for
>>> dnssec-analyzer-gslb.verisignlabs.com.
>>> dnssec-analyzer-gslb.verisignlabs.com has address 209.131.158.42
>>>
>> Right, the IPv4 address lookup works.  Now try looking up the IPv6 
>> address.
>
> if there was one it would be presented there
>
> see here for full answer
>
> # host one.one.one.one
> one.one.one.one has address 1.1.1.1
> one.one.one.one has address 1.0.0.1
> one.one.one.one has IPv6 address 2606:4700:4700::1001
> one.one.one.one has IPv6 address 2606:4700:4700::1111
>
>>
>> I get a status: SERVFAIL instead of a status: NOERROR
>>
>> $ dig dnssec-analyzer.verisignlabs.com aaaa
>>
>> ; <<>> DiG 9.16.48-Debian <<>> dnssec-analyzer.verisignlabs.com aaaa
>> ;; global options: +cmd
>> ;; Got answer:
>> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 60491
>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
>>
>> Lee
>
> this can't be a matter of DNSSEC, as there are only signed whole zones 
> and not just single DNS-records ...
>
> would it be a problem with just this DNS zone, why are only problems 
> getting the IPv6?
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240428/81c37731/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3550 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240428/81c37731/attachment.p7s>