<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class="">
<br class=""><div><blockquote type="cite" class=""><div class="">On Jul 29, 2017, at 5:19 AM, bert hubert <<a href="mailto:bert.hubert@powerdns.com" class="">bert.hubert@powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Sat, Jul 29, 2017 at 12:19:11AM -0400, Charles Sprickman wrote:<br class=""><blockquote type="cite" class="">Here’s a few things I’ve tried:<br class=""><br class="">- Verify with DNSVIZ: <a href="http://dnsviz.net/d/dot.nyc.gov/dnssec/" class="">http://dnsviz.net/d/dot.nyc.gov/dnssec/</a><br class="">- Update PowerDNS to powerdns-recursor-4.0.6<br class="">- Remove “scrub” rules from pf configuration<br class="">- Change pf rules to be stateless<br class="">- Look for denied traffic by running tcpdump against pflog device while performing query<br class="">- Checked record by querying BIND on same host<br class="">- Checked record elsewhere (successful)<br class=""></blockquote><br class="">Thank you for specifying this in so much detail, very appreciated.<br class=""><br class=""><blockquote type="cite" class=""><br class="">Any ideas where to start with this? Anyone else seeing the same issue with this record?<br class=""></blockquote><br class="">We have not heard of this. What we recommend is to enable 'trace' or if that<br class="">is too much, 'trace-regex' for <a href="http://dot.nyc.gov" class="">dot.nyc.gov</a>. This will give a ton of detail<br class="">on what is going on.<br class=""></div></div></blockquote><div><br class=""></div><div>FWIW, “trace-regex” gave me an error, so I just did a full trace and then cleaned up the results.</div><div><br class=""></div><div><a href="https://gist.github.com/sporkman/1b1b01a3b33ca3e2029728cb90a1eee8" class="">https://gist.github.com/sporkman/1b1b01a3b33ca3e2029728cb90a1eee8</a></div><br class=""><blockquote type="cite" class=""><div class=""><div class="">We can then find out the problem for you, or perhaps you see it already.<br class=""></div></div></blockquote><div><br class=""></div><div>I don’t see it, I can’t really follow since I’m actually seeing many of the records I want but then it all seems to fall apart at the end…</div><div><br class=""></div><div>Thanks,</div><div><br class=""></div><div>Charles</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">Good luck and let us know!<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Bert<br class=""></div></div></blockquote></div><br class=""></body></html>