[Pdns-users] Recursor can't resolve login.authorize.net.cdn.cloudflare.net

[Otto Moerbeek]

On Tue, Apr 06, 2021 at 08:49:59PM +0100, Tony Finch via Pdns-users wrote:

> Seth Mattinen via Pdns-users <pdns-users at mailman.powerdns.com> wrote:
> >
> > Here's a partial trace (list refused posting the full trace). From my eye it
> > looks like I'm just getting ServFail from cloudflare NS, or possibly a DNSSEC
> > validation problem.
> 
> The SERVFAIL from the Cloudflare authoritative nameservers causes a DNSSEC
> validation problem:
> 
> 2021-04-06T12:10:24.438708-07:00 dnscache1 pdns_recursor[25026]:
> 	login.authorize.net.cdn.cloudflare.net:
> 	Resolved 'cloudflare.net' NS ns4.cloudflare.net
> 	to: 198.41.223.131, 2400:cb00:2049:1::c629:df83
> 
> 2021-04-06T12:10:24.438946-07:00 dnscache1 pdns_recursor[25026]:
> 	login.authorize.net.cdn.cloudflare.net:
> 	Trying IP 198.41.223.131:53,
> 	asking'login.authorize.net.cdn.cloudflare.net|DS'
> 
> 2021-04-06T12:10:24.439199-07:00 dnscache1 pdns_recursor[25026]:
> 	login.authorize.net.cdn.cloudflare.net:
> 	ns4.cloudflare.net (198.41.223.131)
> 	returned a ServFail, trying sibling IP or NS
> 
> (repeat until everything failed)
> 
> Tony.
> -- 
> f.anthony.n.finch  <dot at dotat.at>  https://dotat.at/
> Great Orme Head to the Mull of Galloway: North or northwest 5 or 6,
> occasionally 7 at first, backing west 2 to 4 later. Moderate becoming
> slight, occasionally smooth later. Squally snow showers, fair later.
> Good occasionally poor.

Yes, there is brakage there. dnsvis is happy, but
https://dnssec-analyzer.verisignlabs.com/login.authorize.net.cdn.cloudflare.net
not.

recursor 4.5.0-beta1 is able to resolve this name, as it has a
different way of determining zone cuts.

Please report the above dnssec-analyzer report to Cloudflare.

	-Otto