On Wed, Jun 23, 2010 at 05:51:24PM +1000, Mark Andrews wrote: > > In message <aanlktinjqorplnyqj5tso2tdwlt_ropzdmrymoiph...@mail.gmail.com>, > Piff > writes: > > Mark, > > > > more than once you have blamed firewal but I have tested without > > firewall and NSxx.DOMAINCONTROL.COM do not answer to "dig +dnssec". > > Wrong. The nameserver DO answer these queries.
Right, unfortunately. All is fine on a freshly reloaded bind, but after a while no answers are seen. This is on Bind 9.4, 9.5 and 9.6. > > # dig +dnssec @ns33.domaincontrol.com. replacementservices.com. > > ; <<>> DiG 9.3.6-P1 <<>> +dnssec @ns33.domaincontrol.com. > replacementservices.com. > ; (1 server found) > ;; global options: printcmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41760 > ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0 > > ;; QUESTION SECTION: > ;replacementservices.com. IN A > > ;; ANSWER SECTION: > replacementservices.com. 3600 IN A 72.32.12.235 > > ;; AUTHORITY SECTION: > replacementservices.com. 3600 IN NS ns33.domaincontrol.com. > replacementservices.com. 3600 IN NS ns34.domaincontrol.com. > > ;; Query time: 346 msec > ;; SERVER: 216.69.185.17#53(216.69.185.17) > ;; WHEN: Wed Jun 23 17:39:43 2010 > ;; MSG SIZE rcvd: 109 > > # # dig +dnssec @ns33.domaincontrol.com. replacementservices.com. ; <<>> DiG 9.6.1-P3 <<>> +dnssec @ns33.domaincontrol.com. replacementservices.com. ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached > > Since you are not getting answers then there is a problem between > you and the nameservers in question and as just about every one > else is getting answers as well this puts the problem close to you. > i.e. Your network or your ISP's network. Something on the path is > doing DPI tests and is rejecting the response. Do you have a NAT > that does DPI? No firewall, DPI, NAT or any form of filtering involved on our side, direct peering with GLBX. -erwin -- Erwin Lansing (o_ _o) http://droso.org Ceterum censeo \\\_\ /_/// Carthaginem esse delendam <____) (____> er...@lansing.dk
pgpLyxBNei27V.pgp
Description: PGP signature
_______________________________________________ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
