<html><head></head><body>True, TCP is broken as well.<br><br><div class="gmail_quote">Am 22. September 2022 10:01:58 MESZ schrieb Otto Moerbeek <otto@drijf.net>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre dir="auto" class="k9mail">On Thu, Sep 22, 2022 at 09:41:57AM +0200, abang--- via Pdns-users wrote:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">The "NSEC3 proving non-existence" of this zone is broken. See<br> <a href="https://dnsviz.net/d/riecis.nl/dnssec/?rr=all&a=all&ds=all&doe=on&ta=.&tk=">https://dnsviz.net/d/riecis.nl/dnssec/?rr=all&a=all&ds=all&doe=on&ta=.&tk=</a><br><br>You can workaround this issue by setting a NTA for it on your Recursors. It is recommended to inform the owner of the zone in order to fix the root cause.<br><br>Winfried <br></blockquote><br>Agreed, but given my findings in the other post I'm not convinced it<br>will solve *all* issues with that domain.<br><br> -Otto<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><br><br><br>Am 22. September 2022 09:27:20 MESZ schrieb Leeflangetje via Pdns-users <pdns-users@mailman.powerdns.com>:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Hi,<br><br>Since we upgraded to pdns-recursor 4.6 we sometimes experience some<br>weird behaviour with queries via pdns-recursor.<br><br>Sometimes, when a previously queried record expires through it's TTL,<br>the recursor does not provide an answer anymore, until it's restarted.<br><br>Unfortunately I am not able to reproduce this. It happens occasionally.<br>When it happens, we see this: <br><br>Faulty server:<br><br>dig @ns1 riecis.nl A<br><br>; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @ns1 riecis.nl A<br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27148<br>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 512<br>;; QUESTION SECTION:<br>;riecis.nl. IN A<br><br>;; AUTHORITY SECTION:<br>riecis.nl. 2828 IN SOA ns1.minvenj.nl. hostmaster.solvinity.com. 2022010301 1800 300 604800 3600<br><br>;; Query time: 2 msec<br>;; SERVER: xxx.xxx.xxx.xxx#53(xxx.xxx.xxx.xxx)<br>;; WHEN: Tue Sep 20 12:16:55 CEST 2022<br>;; MSG SIZE rcvd: 110<br><br>other server:<br><br>dig @ns2 riecis.nl A<br><br>; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @ns2 riecis.nl A<br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61517<br>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 512<br>;; QUESTION SECTION:<br>;riecis.nl. IN A<br><br>;; ANSWER SECTION:<br>riecis.nl. 224 IN A 159.46.204.40<br><br>;; Query time: 1 msec<br>;; SERVER: xxx.xxx.xxx.xxx#53(xxx.xxx.xxx.xxx)<br>;; WHEN: Tue Sep 20 12:17:03 CEST 2022<br>;; MSG SIZE rcvd: 54<br><br><br>We have a fairly simple configuration, just on what address and port to<br> listen on, to use the same address for outgoing queries, en a short li<br>st of addresses that are allowed to query.<br><br>I have confirmed this problem upto and including version 4.6.3<br><br>Anyone an idea on how to approach this matter?<br><br>Regards<br><br><br><br></blockquote></blockquote><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><hr>Pdns-users mailing list<br>Pdns-users@mailman.powerdns.com<br><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br></blockquote><br></pre></blockquote></div></body></html>