<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Dead pdns users,<br>
<br>
I am running a powerdns master with bind backend and a
bind-dnssec-db.<br>
Two superslaves receive their zones from the master using zone
transfer.<br>
<br>
After securing a zone and incrementing the serial, the master
returns RRSIG records if the DO flag is set, but the slaves do not:<br>
<br>
<code> `dig @ns1.digineo.de ssl-tools.net +dnssec`</code> DOES
return the RRSIG entry (live sigining master)<br>
<code>`d</code><code>ig @ns2.digineo.de ssl-tools.net +dnssec`</code>
does NOT return the RRSIG entry (slave)<br>
<br>
You can also check the results at <a
href="http://dnsviz.net/d/ssl-tools.net/dnssec/">http://dnsviz.net/d/ssl-tools.net/dnssec/</a><br>
<br>
If I check the zone files on the slave servers, then RRSIG entries
are present.<br>
<br>
If I send notifications to the slaves, then it produces the
following logs:<br>
Aug 5 17:11:08 h1988784 pdns[12055]: 1 slave domain needs checking,
0 queued for AXFR<br>
Aug 5 17:11:08 h1988784 pdns[12055]: Received serial number updates
for 1 zones, had 0 timeouts<br>
Aug 5 17:11:08 h1988784 pdns[12055]: Domain 'ssl-tools.net' is
fresh (not presigned, no RRSIG check)<br>
<br>
Does anynone know what is wrong with my setup?<br>
<br>
I use pdns-server 3.3 on Ubuntu 14.04.<br>
<br>
Kind Regards<br>
Julian<br>
</body>
</html>