[Unbound-users] problems resolving some sites

[lst_hoe02 at kwsoft.de]

Zitat von FRLinux <frlinux at gmail.com>:

> On Fri, Nov 26, 2010 at 4:01 PM,  <lst_hoe02 at kwsoft.de> wrote:
>> harden-referral-path: yes  (The default is no/off at least according to the
>> docs). See http://www.unbound.net/documentation/unbound.conf.html
>
> Thanks, i have set this one to no, but still fails on a normal query
> but works if I add +cdflag. Am I missing anything else? (my
> configuration is the one i pasted on the first mail, with the change
> you asked for, to set harden-referral-path: no).

We use unbound 1.4.7 and it has no problem to resolv

; <<>> DiG 9.4.2-P2.1 <<>> +dnssec ice.grid.kiae.ru A
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62330
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;ice.grid.kiae.ru.		IN	A

;; ANSWER SECTION:
ice.grid.kiae.ru.	3584	IN	A	144.206.66.32

;; AUTHORITY SECTION:
grid.kiae.ru.		3584	IN	NS	ns.kiae.ru.
grid.kiae.ru.		3584	IN	NS	ns2.grid.kiae.ru.
grid.kiae.ru.		3584	IN	NS	ns.grid.kiae.ru.
grid.kiae.ru.		3584	IN	NS	ns1.grid.kiae.ru.

;; ADDITIONAL SECTION:
ns.grid.kiae.ru.	3584	IN	A	144.206.66.1
ns1.grid.kiae.ru.	3584	IN	A	144.206.66.80
ns2.grid.kiae.ru.	3584	IN	A	144.206.66.90

Fact is if it resolv with +cdflag (checking disable) there is  
something wrong with DNSSEC or someone is screwing the result records.

Regards

Andreas