[root@server~]# dig CAA mail.x.nl @ns1.x.nl. +dnssec ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> CAA mail.x.nl @ns1.x.nl. +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18077 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, …

[image] rickjanssen: Please note that this whole thread is not about vrouwejitske.nl, please forget that domain, i've never said anything about that domain... Use pop.gwvanpelt.nl please. Whoops, sorry for the confusion. Often members here will chime in with example queries trying to help t…

[image] rickjanssen: Please note that this whole thread is not about vrouwejitske.nl, please forget that domain, i've never said anything about that domain... As a quick note: In the future it would be easier to keep this sort of detail straight if you created a separate thread. CAA servfail…

@cpu I am the original poster…

I apologize. You’re correct. Now there’s two confused staff in here :blush:. I’ve updated my comment above for @tgx .

[image] jsha: Jul 19 08:55:14 unbound[24997:0] info: validate(nodata): sec_status_bogus Thank you @jsha , but all responses say "0000" (NOERROR). Do you have any idea? Edit: Can you send over an resolve of an DNSSEC enabled NL domain? Like overheid.nl? And is this pcap the same as the log you…

[image] rickjanssen: Edit2: Can you send over an debug level log? Or your configuration so I don't have to bother you with this. :slight_smile: Here's a log with Unbound verbosity=3. The previous log was at 2. [image] rickjanssen: Was the pcap made when you got the SERVFAIL or was it mad…

Hi @cpu So it seems to me like a DNSSEC validation error, but why whould it fail? According to every DNSSEC test tool I try, DNSSEC is correct. I’ve setup an default config unbound recursor, but it gives NOERROR…

[image] rickjanssen: So it seems to me like a DNSSEC validation error, but why whould it fail? According to every DNSSEC test tool I try, DNSSEC is correct. I've setup an default config unbound recursor, but it gives NOERROR... Agreed. It does seem to boil down to an NSEC failure on the NODAT…

@cpu is there anything I can do? With my unbound setup, the requests do not fail, they give NOERROR

[image] rickjanssen: @cpu is there anything I can do? With my unbound setup, the requests do not fail, they give NOERROR I can't offer any advice at present. I can share a sanitized copy of the config from the server I'm testing against if you want to try and see if you can get your Unbound t…

PowerDNS: Can't find why CAA servfails

Help

Topic		Replies	Views
SERVFAIL looking up CAA, but I see NOERROR myself Help	24	7421	August 8, 2017
Help diagnosing CAA failures `ns1.cyso.nl` Help	13	3699	July 24, 2017
DNS problem: SERVFAIL looking up CAA Help	15	4391	April 8, 2021
CAA requests resulting in SERVFAIL since Dec 12th Help	21	1344	December 20, 2023
False CAA failure when issuing certs Issuance Tech	34	4333	July 10, 2018

PowerDNS: Can't find why CAA servfails

Related topics