<html><head></head><body><div>Thank you for digging into the issue with that domain :)</div><div><br></div><div>The reason we never encountered this before the upgrade to 4.6 must be the change in default behaviour regarding dnssec , which went from "process-no-validate" to "process", I assume.</div><div>(We came from 4.2)</div><div><br></div><div><br></div><div>On Thu, 2022-09-22 at 10:26 +0200, abang--- via Pdns-users wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>True, TCP is broken as well.</div><div><br></div><div>Am 22. September 2022 10:01:58 MESZ schrieb Otto Moerbeek <otto@drijf.net>:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Thu, Sep 22, 2022 at 09:41:57AM +0200, abang--- via Pdns-users wrote:</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>The "NSEC3 proving non-existence" of this zone is broken. See</div><div> https://dnsviz.net/d/riecis.nl/dnssec/?rr=all&a=all&ds=all&doe=on&ta=.&tk=</div><div><br></div><div>You can workaround this issue by setting a NTA for it on your Recursors. It is recommended to inform the owner of the zone in order to fix the root cause.</div><div><br></div><div>Winfried </div><div><br></div></blockquote><div><br></div><div>Agreed, but given my findings in the other post I'm not convinced it</div><div>will solve *all* issues with that domain.</div><div><br></div><div> -Otto</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div><br></div><div><br></div><div><br></div><div>Am 22. September 2022 09:27:20 MESZ schrieb Leeflangetje via Pdns-users <pdns-users@mailman.powerdns.com>:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Hi,</div><div><br></div><div>Since we upgraded to pdns-recursor 4.6 we sometimes experience some</div><div>weird behaviour with queries via pdns-recursor.</div><div><br></div><div>Sometimes, when a previously queried record expires through it's TTL,</div><div>the recursor does not provide an answer anymore, until it's restarted.</div><div><br></div><div>Unfortunately I am not able to reproduce this. It happens occasionally.</div><div>When it happens, we see this: </div><div><br></div><div>Faulty server:</div><div><br></div><div>dig @ns1 riecis.nl A</div><div><br></div><div>; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @ns1 riecis.nl A</div><div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27148</div><div>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 512</div><div>;; QUESTION SECTION:</div><div>;riecis.nl. IN A</div><div><br></div><div>;; AUTHORITY SECTION:</div><div>riecis.nl. 2828 IN SOA ns1.minvenj.nl. hostmaster.solvinity.com. 2022010301 1800 300 604800 3600</div><div><br></div><div>;; Query time: 2 msec</div><div>;; SERVER: xxx.xxx.xxx.xxx#53(xxx.xxx.xxx.xxx)</div><div>;; WHEN: Tue Sep 20 12:16:55 CEST 2022</div><div>;; MSG SIZE rcvd: 110</div><div><br></div><div>other server:</div><div><br></div><div>dig @ns2 riecis.nl A</div><div><br></div><div>; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @ns2 riecis.nl A</div><div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61517</div><div>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 512</div><div>;; QUESTION SECTION:</div><div>;riecis.nl. IN A</div><div><br></div><div>;; ANSWER SECTION:</div><div>riecis.nl. 224 IN A 159.46.204.40</div><div><br></div><div>;; Query time: 1 msec</div><div>;; SERVER: xxx.xxx.xxx.xxx#53(xxx.xxx.xxx.xxx)</div><div>;; WHEN: Tue Sep 20 12:17:03 CEST 2022</div><div>;; MSG SIZE rcvd: 54</div><div><br></div><div><br></div><div>We have a fairly simple configuration, just on what address and port to</div><div> listen on, to use the same address for outgoing queries, en a short li</div><div>st of addresses that are allowed to query.</div><div><br></div><div>I have confirmed this problem upto and including version 4.6.3</div><div><br></div><div>Anyone an idea on how to approach this matter?</div><div><br></div><div>Regards</div><div><br></div><div><br></div><div><br></div></blockquote><div><br></div></blockquote><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Pdns-users mailing list</div><div>Pdns-users@mailman.powerdns.com</div><div>https://mailman.powerdns.com/mailman/listinfo/pdns-users</div><div><br></div></blockquote><div><br></div></blockquote><div>_______________________________________________</div><div>Pdns-users mailing list</div><div>Pdns-users@mailman.powerdns.com</div><div>https://mailman.powerdns.com/mailman/listinfo/pdns-users</div></blockquote><div><br></div><div><span></span></div></body></html>