What is the reason for this DNSSEC validation failure of dnsviz.net?
- by grifferz
On trying to resolve dnsviz.net from a host using an Unbound resolver that is configured to use DNSSEC validation, the result is "no servers could be reached":
$ dig -t soa dnsviz.net
; <<>> DiG 9.6-ESV-R4 <<>> -t soa dnsviz.net
;; global options: +cmd
;; connection timed out; no servers could be reached
Nothing is logged by Unbound to suggest why this is the case.
Here is the /etc/unbound/unbound.conf:
server:
verbosity: 1
interface: 192.168.0.8
interface: 127.0.0.1
interface: ::0
access-control: 0.0.0.0/0 refuse
access-control: ::0/0 refuse
access-control: 127.0.0.0/8 allow_snoop
access-control: 192.168.0.0/16 allow_snoop
chroot: ""
auto-trust-anchor-file: "/etc/unbound/root.key"
val-log-level: 2
python:
remote-control:
control-enable: yes
If I add:
module-config: "iterator"
(thus disabling DNSSEC validation) then I am able to resolve this host normally.
The domain and its DNSSEC check out fine according to
http://dnscheck.iis.se/ so there must be something wrong with my
resolver configuration.
What is it and how do I go about debugging that?
