<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:959603515;
mso-list-type:hybrid;
mso-list-template-ids:1154493188 586054248 1208549401 1208549403 1208549391 1208549401 1208549403 1208549391 1208549401 1208549403;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style></head><body lang="EN-SG" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks,</span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US">Yes, I’m trying to do AXFR of DNSSEC zones from source powerdns (cpanel) to another powerdns server.</span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </span></p><ol style="margin-top:0cm" start="1" type="1"><li class="MsoListParagraph" style="margin-left:0cm">Do you mean I just need it secured at source server that’s all?</li><li class="MsoListParagraph" style="margin-left:0cm">I’m using notify to send the DNSSEC zones to the destination powerdns server. Is there still need to set presigned on the destination powerdns server?</li><li class="MsoListParagraph" style="margin-left:0cm">Cpanel mentioned there seems to be narrow mode on powerdns at their end which prevent the zone transfer of DNSSEC. I am trying to confirm that with them.</li></ol><p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </span></p><p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Pdns-users <<a href="mailto:pdns-users-bounces@mailman.powerdns.com">pdns-users-bounces@mailman.powerdns.com</a>> <b>On Behalf Of </b>Gert van Dijk<br><b>Sent:</b> Thursday, 18 April 2019 4:19 PM<br><b>To:</b> <a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a><br><b>Subject:</b> Re: [Pdns-users] Error in DNSSEC AXFR - Chunk Error Query Refused</span></p><p class="MsoNormal"> </p><div><div><div><div><div><p class="MsoNormal">On Thu, Apr 18, 2019 at 6:44 AM Jackson Yap <<a href="mailto:jackson@apc.sg">jackson@apc.sg</a>> wrote:</p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"><div><div><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi all,</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> </p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We have a strange situation. Previously we are able to do a zone transfer of non-dnssec zones. But now, when we tried to transfer a dnssec zone, we have the error below.</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> </p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Zone is already activated dnssec on source server, and is secured with pdnsutil secure-zone on the destination server.</p></div></div></blockquote><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">I'm not sure I understand what you're trying to do in the first place. Your source server is already serving the domain secured, you state. (Is that also a PowerDNS Authoritative server under your control or not?)</p></div><div><p class="MsoNormal">If your destination server is supposed to be a secondary nameserver, you should set the zone as 'presigned' (`pdnsutil set-presigned [ZONE]`) so that it retrieves the signed zone and serves it as-is.</p></div><div><p class="MsoNormal"> </p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"><div><div><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Apr 18 12:35:49 ns1 pdns_server: Starting AXFR of '<a href="http://xxx.sg" target="_blank">xxx.sg</a>' from remote x.x.x.x</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Apr 18 12:35:49 ns1 pdns_server: Unable to AXFR zone '<a href="http://xxx.sg" target="_blank">xxx.sg</a>' from remote x.x.x.x (resolver): AXFR chunk error: Query Refuse</p></div></div></blockquote><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Are your sure your source server accepts zone transfers from the IP of your destination server? It seems it does not allow you to. If your source server is not under your control, additional restrictions may be applied like TSIG [1], but I'm not too familiar if you would get this specific error message on your destination server.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">[1]: <a href="https://doc.powerdns.com/authoritative/tsig.html">https://doc.powerdns.com/authoritative/tsig.html</a></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">HTH</p></div></div></div></div></div></div></body></html>