DNSViz is usually the go-to tool when trouble shooting is-it-me-or-is-it-them DNSSEC issues, but it’s thorough enough to help for a lot more general problems too.
Someone else has been using it to check that name, https://dnsviz.net/d/www.ecb.europa.eu/dnssec/ The only thing that pops up that might hint at your problem are a couple of unresponsive servers in the mix. Questionable that it’s really a cause to your problem. A note about the “dig +trace” below. They’re pretty and all, but really aren’t a good representation of what your resolver really does. In your case for example, it quits when it gets the CNAME. It doesn’t follow through to get the A record it points to. Problems with QNAME minimization, “bad” data in the cache, and other things won’t show up in a +trace. On Fri, Jun 17, 2022 at 4:05 AM Matus UHLAR - fantomas <uh...@fantomas.sk> wrote: > Hello, > > I encountered case where resolution of www.ecb.europa.eu takes long time > and > I can't find out why. > > I'm trying to find the culprit using dig +trace and resolution times > change > from < 1 second to > 15 seconds, while response times reported by dig say > miliseconds. > > multiple runs of dig seem to fix the issue until I clear named cache. > (which indicated problem is in DNS, but I still have no idea where) > > I'm out od ideas what to search for. > > I have debian 11 with bind version 1:9.16.27-1~deb11u1 > > an example dig that took 5 seconds pasted: > > # time dig +trace www.ecb.europa.eu > > ; <<>> DiG 9.16.27-Debian <<>> +trace www.ecb.europa.eu > ;; global options: +cmd > . 194472 IN NS m.root-servers.net. > . 194472 IN NS k.root-servers.net. > . 194472 IN NS f.root-servers.net. > . 194472 IN NS g.root-servers.net. > . 194472 IN NS h.root-servers.net. > . 194472 IN NS d.root-servers.net. > . 194472 IN NS b.root-servers.net. > . 194472 IN NS c.root-servers.net. > . 194472 IN NS l.root-servers.net. > . 194472 IN NS e.root-servers.net. > . 194472 IN NS j.root-servers.net. > . 194472 IN NS a.root-servers.net. > . 194472 IN NS i.root-servers.net. > . 194472 IN RRSIG NS 8 0 518400 > 20220626050000 20220613040000 47671 . > iUnxO5EIpOY35jg5SR2+ZW9mYcieUMFZn2JwNHpEPW/YxGfXh+XjLXpC > n+ByMYEB2L1b1zzcx86wnyKxnuhU8O/EH63w13op+lo+MxVOJlFOribp > 6jV2BZn+fHCJDE/5VHtSGYI741Uf1aUudjrX7htYVngg7Z1eTI0PinGN > Z46j/xRcwk5KlHKExmgQSlS1FrLT0yiBeT6Tg48guYfYKbpDNIcy3vS4 > 7BIv7U0jDmynl8cOYlfgDH2Nft6Vw3vrrVjMFkyWsIdFCsfejrff8UqR > JhuE47lm0JdhV7z+3NfoJRANaRjAfD0ufB1chXuFQpsuquAZ907fh+e3 +Ny+kg== > ;; Received 1137 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms > > eu. 172800 IN NS x.dns.eu. > eu. 172800 IN NS si.dns.eu. > eu. 172800 IN NS be.dns.eu. > eu. 172800 IN NS w.dns.eu. > eu. 172800 IN NS y.dns.eu. > eu. 86400 IN DS 59479 8 2 > 5DBAA81BC0BEFE921886D8DA28498D9FD441B457FB0E3642A0B2F981 1C8E15E0 > eu. 86400 IN RRSIG DS 8 1 86400 > 20220630050000 20220617040000 47671 . > ng+6lWObqlR9d72YQ+i4K5NGoIqgUfgADqrrrw83a7nVIZzM0vLNwsA2 > h7lOAClHLNzYtaSh3Y9RmjjfaOEggPX/qHe1CXr9OG+Ezn1TiQHIBZ8b > EDO2sub4oUG6SqBCM4TEcFodiDV1XaNhOFxbQ++7woya3JlDGfG77Dpi > osL8LqZNwvrMcMglfC/anDJwPkE4n4Ywd/UMpsG6+An/HSMn/DLRmaBy > Xt1IhMzRZKeIshqVLS0i/JT8A2jzFQjhn80CGAoGe7Lfhk393E81Bm2h > lJGsBFaPdoX8oLjvPsjk7kgu4RCNM82zR0GAA0CxJurph7u/PQDlNwFY EqvVOQ== > ;; Received 719 bytes from 192.112.36.4#53(g.root-servers.net) in 19 ms > > europa.eu. 86400 IN NS ns1.bt.net. > europa.eu. 86400 IN NS ns2eu.bt.net. > europa.eu. 86400 IN NS ns1bru.europa.eu. > europa.eu. 86400 IN NS ns1lux.europa.eu. > europa.eu. 86400 IN NS ns2bru.europa.eu. > europa.eu. 86400 IN NS ns2lux.europa.eu. > europa.eu. 86400 IN NS ns3bru.europa.eu. > europa.eu. 86400 IN NS ns3lux.europa.eu. > europa.eu. 86400 IN NS ns4az1.europa.eu. > europa.eu. 86400 IN DS 6250 8 2 > 0186EEFF28A83D2C950963CEEF2F2070DC0885AC8AD7106B03A9741C 25DC6B82 > europa.eu. 86400 IN DS 14845 8 2 > 9EF3C28F5B3A3D33756D61715B1BDBDBB07E0555598D30256D1F2B71 95324846 > europa.eu. 86400 IN RRSIG DS 8 2 86400 > 20220623041700 20220616041129 27435 eu. > XakdaRA9D2dJc7PciufTV202vD0+QVIjdHl0G9IVkvF/UNEOZCheEJs8 > F/+Dv+mVVfVyNTlBpi+gRLmj6RNw6BN1vD4C5TNsniS/s5r//IDJd7p9 > Sn7pviz7YgZigyVfI0lFE62tZw5zdotpqKhvtro/Pit/16MvdnmKWjvb u8I= > ;; Received 691 bytes from 194.0.25.28#53(w.dns.eu) in 15 ms > > ecb.europa.eu. 3600 IN NS ns1.coltnet.at. > ecb.europa.eu. 3600 IN NS pdns109.ultradns.net. > ecb.europa.eu. 3600 IN NS pdns109.ultradns.biz. > ecb.europa.eu. 3600 IN NS pdns109.ultradns.org. > ecb.europa.eu. 3600 IN NS ns8.colt.net. > ecb.europa.eu. 3600 IN NS pdns109.ultradns.com. > ecb.europa.eu. 1800 IN NSEC ecdc.europa.eu. NS RRSIG > NSEC > ecb.europa.eu. 1800 IN RRSIG NSEC 8 3 1800 > 20220628104634 20220617040432 45108 europa.eu. > W6Sf4qHBcTkjXR8cnt/hG1mAicP6RsgwE+dR9jqNoPT7eAb1jgd/qh6R > Jw71BT9Otghuu2aMNtMm4ZhwNrN8YpR0HyxHx5mDO3DZsO4Sqx21+cmp > /zUn22xECJI3oVQy5qKczejRQLFiQY7yPg+57Z2V5Zj7lvdDDG8f2IeJ > QY75DcTLFuWriUS1Qos1+koXYox4qmAXjq6BgN8/T82iVpYqPjBMxoVJ > pjcWnEO/GYzcVOZXQefDNPivF3TeeojbgPt5pmBhz29MlflPi0i1GAna > mg1soT9JnEDFmK1y6Va7yVrOPFbpuslSfJSX710JFwVEZsEBfXSWt7ZE sp7gYQ== > ecb.europa.eu. 1800 IN RRSIG NSEC 8 3 1800 > 20220715202454 20220617040450 33483 europa.eu. > CsLsmCuiFgHEzpPIFcecZojRcm8CmuV6laZJP0kca+xmbUMKiYV9aDoZ > Yq9+DAPHJBdnYXUHAGPjLuxC+jfWSwUg2k3t/obrFFYz3MOV2xf802Az > mrwjQKbozUVVfiftuPl+n+iaw60ocqyfH1Ev8qDBjiMJ3a382VUWFu5r > DP2mpJ9vl9xvAMxN51uZ38lSkXArVEU8t84OMr7Dh6zikvcIlbwaj3TH > RFsqoDIB3yfPuAAJksqvxWg8DPARONUHfHZ7njiWef3njjwfcGnRv7sn > MecG5j0hL2SrfHxI4eqbxRabOzZ2gzLUh37aIFnptHHcZy84fJgT0Ve1 sE1iOg== > ;; Received 891 bytes from 147.67.12.4#53(ns3lux.europa.eu) in 15 ms > > www.ecb.europa.eu. 300 IN CNAME www-ecb-europa-eu.ax4z.com > . > ;; Received 86 bytes from 156.154.65.109#53(pdns109.ultradns.net) in 11 ms > > real 0m5.117s > user 0m0.011s > sys 0m0.035s > > -- > Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ > Warning: I wish NOT to receive e-mail advertising to this address. > Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > "One World. One Web. One Program." - Microsoft promotional advertisement > "Ein Volk, ein Reich, ein Fuhrer!" - Adolf Hitler > -- > Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe > from this list > > ISC funds the development of this software with paid support > subscriptions. Contact us at https://www.isc.org/contact/ for more > information. > > > bind-users mailing list > bind-users@lists.isc.org > https://lists.isc.org/mailman/listinfo/bind-users > >
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users