Hi,
> On Thu, Aug 20, 2026 at 10:45:17PM -0700, Crist Clark wrote:
> ! Best practice is not to cache the root, but mirror it (RFC 8806). Mirroring
> ! and writing it to a local file would have prevented this. Something like,
> !
> ! zone "." {
> ! type mirror;
> ! file "/var/cache/bind/root.mirror";
> ! };
>
> This didn't work for me.
> (My log-book says, the problem is that a mirror zone needs an explicit
> trust anchor.)
Full logs would be useful to understand what is going on there then.
The whole mirrored zone is validated during the transfer or when loaded from
disk (and the default locally known trust-anchors should enable the validation,
even if offline). Thus answering queries shouldn't need to re-validate the root
zone since it's already validated.
Perhaps the machine running named has a clock issue? Or the mirror zone is an
area where the db file get removed at some point?
I just did tried the same thing on 9.20.26:
- having a running named instance with mirror root zone
- shutting down network
- stopping/starting named again
- dig DNSKEY . @::1 # works, with ad flag
- dig isc.org @::1 # obviously fails
- starting network again and waited few seconds
- dig isc.org @::1 # then answer, with ad flag.
Regards,
--
Colin Vidal -- [email protected]
Internet Systems Consortium
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
