[root@server~]# dig CAA mail.x.nl @ns1.x.nl. +dnssec ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> CAA mail.x.nl @ns1.x.nl. +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18077 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, …

[image] cpu: I shared an Unbound configuration above that can be used to try and replicate locally. @rickjanssen seems to have success with that. It's not the exact configuration we run in production but seems sufficient for replicating the issue in so much as I understand it presently. Can you …

One thing that stands out to me is that in the snippet that @cpu posted your nameserver returned an unexpected NSEC record which doesn’t prove the NODATA response (mail.gwvanpelt.nl. 86400 IN NSEC pop.gwvanpelt.nl. A AAAA RRSIG NSEC which would authenticate a mail.gwvanpelt.nl. NODATA response but n…

This any help? http://dnsviz.net/d/pop.gwvanpelt.nl/dnssec/?rr=257&a=all&ds=all&doe=on&ta=.&tk=

@jsha We do not use anycast, but I can explain a little further what happens now: nsX had no questions about sub.domain.nl -> cache is clear nsX receives a quistion about CAA of sub.domain.nl -> cache is filled with TTL of 300 seconds -> request verified nsX receives after 45 seconds another call…

[image] weppos: I sent you the error and the names via email. I replied there. Since I'm confident this is a distinct root cause from the one affecting @rickjanssen I'm going to split your posts into a separate thread to keep this one clear. Thanks!

I’ve made a pass to split off the folks that piled onto this thread so we can help individually. The root cause differs case-to-case. To help avoid more pile-on’s I updated the title of this thread to mention PowerDNS since presently it seems the root cause in this case will be related to that DNS s…

I made a tool that makes it easier to make queries against a DNSSEC-validating Unbound instance and see the debug logs: https://unboundtest.com/ . Hopefully it's helpful. @rickjanssen based on your comments about how you reproduced more reliably, I tried blocking ns1.zxcs.nl and ns2.zxcs.nl in iptabl…

I’m still figuring out what causes this to happen. Indeed, we figured that if we add a CAA record the problem is worked around, but we can’t add it for everyone. We plan on automatically adding the record when requesting a Let’sEncrypt certificate. Only CAA has this, although I haven’t tested TXT,…

Whoops, posted on the wrong thread. Moving that post to the right thread.

[image] rickjanssen: Only CAA has this, although I haven't tested TXT, but A works. The reason I suggest TXT is that for most domains it will be an empty response, while the response for A is non-empty. It seems like there are potentially issues specifically around empty responses.

PowerDNS: Can't find why CAA servfails

Help

Topic		Replies	Views
SERVFAIL looking up CAA, but I see NOERROR myself Help	24	7432	August 8, 2017
Help diagnosing CAA failures `ns1.cyso.nl` Help	13	3705	July 24, 2017
DNS problem: SERVFAIL looking up CAA Help	15	4396	April 8, 2021
CAA requests resulting in SERVFAIL since Dec 12th Help	21	1352	December 20, 2023
False CAA failure when issuing certs Issuance Tech	34	4343	July 10, 2018

PowerDNS: Can't find why CAA servfails

Related topics