[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Dns sometimes fails using Google DNS / automatic dnssec
Jay Ford <jay-ford at uiowa.edu> wrote:
> It looks like if the server has the RRSIG RR, it returns it. For example, a
> query with +dnssec will cause it to cache the RRSIG, after which it returns
> it even if +dnssec not specified.
It's weird. If you repeatedly query 220.127.116.11 without the DO bit, you get a
mixture of responses with and without an RRSIG and with varying TTLs. With
DO it appears to consistently return an RRSIG in the answer and the TTL
drops monotonically. 18.104.22.168 is similar except DO=0 replies don't include
RRSIGs. (Querying from JANET UK and hitting some servers a lethargic 12ms
while sleep 1; do dig +dnssec @22.214.171.124 m1.mailplus.nl; done
f.anthony.n.finch <dot at dotat.at> http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.