[root@server~]# dig CAA mail.x.nl @ns1.x.nl. +dnssec ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> CAA mail.x.nl @ns1.x.nl. +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18077 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, …

@rickjanssen I’m still curious about whether your nameservers are anycast. If so, that could potentially explain random differences, if queries are routed to different servers. Also, sounds like you’re running PowerDNS. What version? I assume you’re running the same version on all nameservers? Also…

[image] cpu: I shared an Unbound configuration above that can be used to try and replicate locally. @rickjanssen seems to have success with that. It's not the exact configuration we run in production but seems sufficient for replicating the issue in so much as I understand it presently. Can you …

One thing that stands out to me is that in the snippet that @cpu posted your nameserver returned an unexpected NSEC record which doesn’t prove the NODATA response (mail.gwvanpelt.nl. 86400 IN NSEC pop.gwvanpelt.nl. A AAAA RRSIG NSEC which would authenticate a mail.gwvanpelt.nl. NODATA response but n…

This any help? http://dnsviz.net/d/pop.gwvanpelt.nl/dnssec/?rr=257&a=all&ds=all&doe=on&ta=.&tk=

@jsha We do not use anycast, but I can explain a little further what happens now: nsX had no questions about sub.domain.nl -> cache is clear nsX receives a quistion about CAA of sub.domain.nl -> cache is filled with TTL of 300 seconds -> request verified nsX receives after 45 seconds another call…

I’ve made a pass to split off the folks that piled onto this thread so we can help individually. The root cause differs case-to-case. To help avoid more pile-on’s I updated the title of this thread to mention PowerDNS since presently it seems the root cause in this case will be related to that DNS s…

I made a tool that makes it easier to make queries against a DNSSEC-validating Unbound instance and see the debug logs: https://unboundtest.com/ . Hopefully it's helpful. @rickjanssen based on your comments about how you reproduced more reliably, I tried blocking ns1.zxcs.nl and ns2.zxcs.nl in iptabl…

I’m still figuring out what causes this to happen. Indeed, we figured that if we add a CAA record the problem is worked around, but we can’t add it for everyone. We plan on automatically adding the record when requesting a Let’sEncrypt certificate. Only CAA has this, although I haven’t tested TXT,…

Whoops, posted on the wrong thread. Moving that post to the right thread.

PowerDNS: Can't find why CAA servfails

Help

cpu July 19, 2017, 6:33pm 46

I replied there. Since I'm confident this is a distinct root cause from the one affecting @rickjanssen I'm going to split your posts into a separate thread to keep this one clear. Thanks!

Topic		Replies	Views
SERVFAIL looking up CAA, but I see NOERROR myself Help	25	7415	September 7, 2017
Help diagnosing CAA failures `ns1.cyso.nl` Help	14	3685	August 23, 2017
DNS problem: SERVFAIL looking up CAA Help	16	4368	May 8, 2021
CAA requests resulting in SERVFAIL since Dec 12th Help	22	1334	January 19, 2024
False CAA failure when issuing certs Issuance Tech	35	4302	August 9, 2018

PowerDNS: Can't find why CAA servfails

Related topics