Not sure if it's similar, but the wife was trying to go to one of those designer check places that always sends you junk in the mail... in this case <a href="http://www.checksunlimited.com">www.checksunlimited.com</a>.<div>
<br></div><div>Lookups always SERVFAIL for the domain <a href="http://checksunlimited.com">checksunlimited.com</a>. Running unbound in debug, it always sets the results to THROWAWAY. I tried to debug it, but it quickly went over my head.</div>
<div><br></div><div>Went back to my old dnscache setup that unbound replaced, and it worked fine :(.</div><div><br></div><div>-Dustin<br><br><div class="gmail_quote">On Thu, May 13, 2010 at 8:26 AM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On Thu, 13 May 2010, Mike Emigh wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
We ran across a new problem in what appears to be parent-child<br>
disagreement on version 1.4.4. The resolution appears to work as<br>
expected when digging for A records in the domain, but if you first<br>
dig for the NS (starting with an empty cache), then subsequent A<br>
record lookups fail.<br>
</blockquote>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
If you dig <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a> NS, it returns an invalid response:<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. 3600 IN NS netdns.<br>
<br>
Then trying to resolve an A record from this domain results in a SERVFAIL:<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1462<br>
</blockquote>
<br></div>
I did this against a non-dnssec bind, and it produced the same result.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br>
<br>
;; QUESTION SECTION:<br>
;<a href="http://www.safesvc.gov.cn" target="_blank">www.safesvc.gov.cn</a>. IN A<br>
<br>
The A query appears to work as expected if the you never issue the<br>
'dig <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a> NS' command.<br>
</blockquote>
<br></div>
Except I always get a servfail for <a href="http://www.safesvc.gov.cn" target="_blank">www.safesvc.gov.cn</a>.<br>
<br>
The domain is pretty broken:<br>
<br>
$ dnscheck <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>.<br>
0.000: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. INFO Begin testing zone <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. with version 0.93_01.<br>
0.000: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. INFO Begin testing delegation for <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>..<br>
9.067: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. INFO Name servers listed at parent: <a href="http://netdns.safesvc.com.cn" target="_blank">netdns.safesvc.com.cn</a><br>
9.387: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. ERROR No name servers found at child.<br>
9.387: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. ERROR Superfluous name server listed at parent: <a href="http://netdns.safesvc.com.cn" target="_blank">netdns.safesvc.com.cn</a><br>
9.388: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. ERROR Too few name servers (0).<br>
9.388: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. INFO Done testing delegation for <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>..<br>
9.388: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. CRITICAL Fatal error in delegation for zone <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>..<br>
9.388: <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>. INFO Test completed for zone <a href="http://safesvc.gov.cn" target="_blank">safesvc.gov.cn</a>..<div><div></div><div class="h5"><br>
$<br>
_______________________________________________<br>
Unbound-users mailing list<br>
<a href="mailto:Unbound-users@unbound.net" target="_blank">Unbound-users@unbound.net</a><br>
<a href="http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users" target="_blank">http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
</div></div></blockquote></div><br></div>