DNSSEC failures since this morning

Software SW help
1

Hi,

This morning’s unpleasant surprise: I could no longer resolve any subdomains of ec.europa.eu (nslookup error SERVFAIL); disabling DNSSEC was the only way to get back to work. Verisign DNSSEC analyzer shows that the issue is not with the European Commission’s DNS servers, so I’m assuming that the problem is either in my Turris Omnia [freshly updated and rebooted to re-test], or in the forwarder (I’ve tried Google, CloudFlare, and my ISP’s DNS resolver). Any suggestions on how to diagnose this?

2

Maybe with a concrete example? I tried foo.ec.europa.eu and it seems bogus:

3

Example without dnssec enabled:

bob@orion ~ $ dig myremote.ec.europa.eu

; <<>> DiG 9.16.22 <<>> myremote.ec.europa.eu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48442
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;myremote.ec.europa.eu.		IN	A

;; ANSWER SECTION:
myremote.ec.europa.eu.	60	IN	A	147.67.46.13
myremote.ec.europa.eu.	60	IN	A	147.67.222.13

;; Query time: 104 msec
;; SERVER: 192.168.55.1#53(192.168.55.1)
;; WHEN: Wed Dec 08 10:54:11 CET 2021
;; MSG SIZE  rcvd: 82

Same domain name with DNSSEC enabled:

bob@orion ~ $ dig myremote.ec.europa.eu

; <<>> DiG 9.16.22 <<>> myremote.ec.europa.eu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61192
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;myremote.ec.europa.eu.		IN	A

;; Query time: 350 msec
;; SERVER: 192.168.55.1#53(192.168.55.1)
;; WHEN: Wed Dec 08 10:56:09 CET 2021
;; MSG SIZE  rcvd: 50

Configured with CloudFlare as DNS provider in ReForis.

4

Hello,
can you please go to Diagnostics and generate a diagnostic report for the DNS and networking subsystem, and put it here?

5

No need, it’s easy to reproduce, and I see what exactly is going on.

2 Likes
6

Well, the problem boils down to the same origin as the SERVFAIL I posted. europa.eu SOA is not served signed, for whatever reason. So whenever any validator encounters a negative response, it can’t succeed because SOA is mandatory in there.

Now myremote.ec.europa.eu should be OK if you turn off forwarding (works on my Omnia), but Knot Resolver’s forwarding algorithm is unable to avoid some intermediary queries which get negative replies here – so it runs into this SOA bug here and gets stuck.

7

I’ll try to contact “them”.

8

I’ll forward your diagnostics to the IT Helpdesk.

9

EC Helpdesk has made a first attempt to fix the issue, but I’m not seeing any difference on my end.

10

It looks good on my end, even tested Omnia with forwarding. Perhaps some of it was still cached on your forwarder(s)?

11

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.