Hi, Since upgrading BIND on my Arch Linux system to 9.21.26 (compiled myself from source), it now shows resolver priming query failure every time it starts up. The log writes:
```
Sep 28 10:27:52 archie.me named[579]: using built-in root key for view _default
Sep 28 10:27:52 archie.me named[579]: set up managed keys zone for view
_default, file 'managed-keys.bind'
Sep 28 10:27:52 archie.me named[579]: command channel listening on 127.0.0.1#953
Sep 28 10:27:53 archie.me named[579]: managed-keys-zone: loaded serial 7096
Sep 28 10:27:53 archie.me named[579]: zone
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN:
loaded serial 42
Sep 28 10:27:53 archie.me named[579]: zone localhost/IN: loaded serial 42
Sep 28 10:27:53 archie.me named[579]: zone 0.0.127.in-addr.arpa/IN: loaded
serial 42
Sep 28 10:27:53 archie.me named[579]: all zones loaded
Sep 28 10:27:53 archie.me named[579]: FIPS mode is disabled
Sep 28 10:27:53 archie.me named[579]: running
Sep 28 10:27:57 archie.me named[579]: managed-keys-zone: Key 20326 for zone .
is now trusted (acceptance timer complete)
Sep 28 10:27:57 archie.me named[579]: managed-keys-zone: Key 38696 for zone .
is now trusted (acceptance timer complete)
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
a.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
d.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
k.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
l.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
h.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
e.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
m.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
j.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
i.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
f.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
g.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
b.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for
c.root-servers.net
Sep 28 10:27:57 archie.me named[579]: resolver priming query complete: failure
```
BIND 9.21.25 (possibly) don't exhibit this failure.
The configuration I use (in `/etc/named.conf`):
```
tls quad9 {
ca-file "/etc/ssl/certs/ca-certificates.crt";
remote-hostname "dns.quad9.net";
};
tls adguard {
ca-file "/etc/ssl/certs/ca-certificates.crt";
remote-hostname "unfiltered.adguard-dns.com";
};
options {
directory "/var/named";
pid-file "/run/named/named.pid";
listen-on-v6 { none; };
listen-on { 127.0.0.53; };
allow-recursion { 127.0.0.1; 127.0.0.53; 192.168.0.0/24; ::1; };
allow-transfer { none; };
allow-update { none; };
max-cache-size 128M;
forwarders {
9.9.9.9 port 853 tls quad9;
149.112.112.112 port 853 tls quad9;
94.140.14.14 port 853 tls adguard;
94.140.15.15 port 853 tls adguard;
};
forward only;
version none;
hostname none;
server-id none;
};
```
(Note that I'm using global forwarding to DoT upstreams since I'm in a home
network where port 53 is firewalled (i.e. MITM'ed to ISP resolvers).)
Am I missing something? Is it a genuine bug?
Thanks.
--
An old man doll... just what I always wanted! - Clara
signature.asc
Description: PGP signature
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
