0

My DNSsec began to fail following a ports update. I have reinstalled Bind on both master and slave but the error still persist.

35  ;; WE HAVE MATERIAL, WE NOW DO VALIDATION
36  ;; VERIFYING A RRset for www.ex-mailer.com. with DNSKEY:9381: success
37  ;; OK We found DNSKEY (or more) to validate the RRset
38  ;; Now, we are going to validate this DNSKEY by the DS
39  ;; ERROR no DS validates a DNSKEY in the DNSKEY RRset: FAILED

complete dig output dig output

VeriSign says I am good to go VeriSign diag

and there are no error in the bind logs.

how do I find what is causing this error and get rid of it/restore my DNSsec?

Update: It's not stale cache. Queries from fresh remote networks obtain same results.

Improve this question

1 Answer 1

Reset to default
0

Looking at your dig +sigchase output, we can see that the KSK (SEP) DNSKEY is:

ex-mailer.com.          86400   IN      DNSKEY  257 3 8 AwEAAaer0hZ5wLS++AsZyIEea+hqFzH4VKCWtFrLIUIqPU368szAfq9q 58adbqXjbizWGVimZEhVgDdUbl+TI3hQQ8eppOpX5yPr49XNv3AP6IbT pUlXAEXUjb6DsTONKciWHxo8r0Es7KL/SJSWmd3aTqtMeIrxb2SSFRmH upy034CKgrniidBv2VVI1pGsvLIDn3HYWMHqUas81iDv8EJ6c1HYiVUf w+37kfFZtj4pUmFQwwZ5yfi8pECPwLV5QImsnT3QGV2sYGP0sDWgGpz+ Sbv3+fs2u1o5AzD5nB7FeTotSdl31J0BKNpOT3gIG3JvkCaRziqqkCnL 7p+5t4+1dqE=

We can also see that the DS you found was:

ex-mailer.com.          85868   IN      DS      30274 8 1 9D12E47AAB1817A5062590188B7FC849FB662CE3

However, if I check what the DS should be for the above DNSKEY I get:

$ echo "ex-mailer.com.          86400   IN      DNSKEY  257 3 8 AwEAAaer0hZ5wLS++AsZyIEea+hqFzH4VKCWtFrLIUIqPU368szAfq9q 58adbqXjbizWGVimZEhVgDdUbl+TI3hQQ8eppOpX5yPr49XNv3AP6IbT pUlXAEXUjb6DsTONKciWHxo8r0Es7KL/SJSWmd3aTqtMeIrxb2SSFRmH upy034CKgrniidBv2VVI1pGsvLIDn3HYWMHqUas81iDv8EJ6c1HYiVUf w+37kfFZtj4pUmFQwwZ5yfi8pECPwLV5QImsnT3QGV2sYGP0sDWgGpz+ Sbv3+fs2u1o5AzD5nB7FeTotSdl31J0BKNpOT3gIG3JvkCaRziqqkCnL 7p+5t4+1dqE=" | dnssec-dsfromkey -1 -f - ex-mailer.com
ex-mailer.com. IN DS 47569 8 1 42665F3D9A532B16A8E5AD9564AF9936AC93F7A0

There's clearly a mismatch between the DS you looked up and the KSK currently used.

For what it's worth, I get the correct DS if I look it up myself:

$ dig @a.gtld-servers.net ex-mailer.com DS +norec +short
47569 8 1 42665F3D9A532B16A8E5AD9564AF9936AC93F7A0

It appears that the keys for ex-mailer.com may have changed in some unplanned way (not rolled over in a controlled manner) which leaves validating resolver servers in a bad state until cached data expires.

Improve this answer
5
  • Lindqvist I am not sure if you are correct, the DS record was changed but way early yesterday. Here is a discussion on #dns where much the same was discussed. bpaste.net/show/7be7bbc9d676 I guess we will see tomorrow. I'll keep this post updated.
    – nix
    Jun 5, 2015 at 18:31
  • at this point it has been 3 days since the update and I have attempted from 3 different networks. Both TLD with registrar gkg.com and canonical domain with registrar godaddy, are having the same fail.
    – nix
    Jun 6, 2015 at 15:31
  • @nix Ok. I think you'll need to provide more details in that case. I can't reproduce the problem and what I answered was the immediately obvious problem from what you showed before.
    – Håkan Lindqvist
    Jun 6, 2015 at 15:41
  • It looks like an ISP error i.imgur.com/Se0LMGC.png and a deeper diagnostic discussion bpaste.net/show/e4f1f3e4f1cb
    – nix
    Jun 6, 2015 at 17:56
  • @nix That looks like a different problem than what you asked about here...?
    – Håkan Lindqvist
    Jun 6, 2015 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .