Hi, I have trouble resolving some addresses with my freeipa server . in the log there are lots of "broken trust chain" lines. like:
validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/A/IN': 8.8.8.8#53 May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/TYPE65/IN': 8.8.8.8#53 I setup a global forward to 8.8.8.8 and forward only setting in the web gui. I tried to change the dnssec settings in /etc/named.conf : dnssec-enable no; dnssec-validation no; That did not help. I run freeipa 4.6.8. Release: 5.el7.centos.12 on centos7.9 When I change forwarding to: forward disabled in the webgui, i get lots of "network unreachable resolving" in the logs. I then can resolve most addresses but not all To me looks like dns is not resolving as expected, but have no clue in where to look for a solution. Any help appreciated. Thanks, Rob. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
