Hello Robert,

thanks for hint. The trace:

curl http://localhost:8453/trace/connectivity.samsung.com.cn
[iterat][4123608.00]   'connectivity.samsung.com.cn.' type 'A' new uid was assigned .01, parent uid .00
[cache ][4123608.01]   => no NSEC* cached for zone: samsung.com.cn.
[cache ][4123608.01]   => skipping zone: samsung.com.cn., NSEC, hash 0;new TTL -123456789, ret -2
[cache ][4123608.01]   => skipping zone: samsung.com.cn., NSEC, hash 0;new TTL -123456789, ret -2
[zoncut][4123608.01]   found cut: samsung.com.cn. (rank 010 return codes: DS 1, DNSKEY 1)
[resolv][4123608.01]   => NS is provably without DS, going insecure
[select][4123608.01]   => id: '61652' choosing: 'dns1.esamsungchina.com.cn.'@'27.106.204.42#00053' with timeout 10000 ms zone cut: 'samsung.com.cn.'
[resolv][4123608.01]   => id: '61652' querying: 'dns1.esamsungchina.com.cn.'@'27.106.204.42#00053' zone cut: 'samsung.com.cn.' qname: 'coNNECTIVitY.SAMSunG.com.CN.' qtype: 'A' proto: 'tcp'
[worker][4123608.01]   => connecting to: '27.106.204.42#00053'
[worker][4123608.01]   => connection to '27.106.204.42#00053' failed (internal timeout)
[select][4123608.01]   => id: '61652' noting selection error: 'dns1.esamsungchina.com.cn.'@'27.106.204.42#00053' zone cut: 'samsung.com.cn.' error: 4 TCP_CONNECT_TIMEOUT
[iterat][4123608.01]   'connectivity.samsung.com.cn.' type 'A' new uid was assigned .02, parent uid .00
[select][4123608.02]   => id: '65410' choosing to resolve AAAA: 'dns1.esamsungchina.com.cn.' zone cut: 'samsung.com.cn.'
[plan  ][4123608.02]   plan 'dns1.esamsungchina.com.cn.' type 'AAAA' uid [4123608.03]
[iterat][4123608.03]     'dns1.esamsungchina.com.cn.' type 'AAAA' new uid was assigned .04, parent uid .02
[cache ][4123608.04]     => no NSEC* cached for zone: esamsungchina.com.cn.
[cache ][4123608.04]     => skipping zone: esamsungchina.com.cn., NSEC, hash 0;new TTL -123456789, ret -2
[cache ][4123608.04]     => skipping zone: esamsungchina.com.cn., NSEC, hash 0;new TTL -123456789, ret -2
[zoncut][4123608.04]     found cut: esamsungchina.com.cn. (rank 010 return codes: DS 1, DNSKEY 1)
[resolv][4123608.04]     => NS is provably without DS, going insecure
[select][4123608.04]     => id: '29392' choosing: 'dns.esamsungchina.com.cn.'@'27.106.204.41#00053' with timeout 10000 ms zone cut: 'esamsungchina.com.cn.'
[resolv][4123608.04]     => id: '29392' querying: 'dns.esamsungchina.com.cn.'@'27.106.204.41#00053' zone cut: 'esamsungchina.com.cn.' qname: 'DNS1.ESAMsUNgchiNa.coM.cN.' qtype: 'AAAA' proto: 'tcp'
[worker][4123608.04]     => connecting to: '27.106.204.41#00053'
[worker][4123608.04]     => connection to '27.106.204.41#00053' failed (internal timeout)
[select][4123608.04]     => id: '29392' noting selection error: 'dns.esamsungchina.com.cn.'@'27.106.204.41#00053' zone cut: 'esamsungchina.com.cn.' error: 4 TCP_CONNECT_TIMEOUT
[iterat][4123608.04]     'dns1.esamsungchina.com.cn.' type 'AAAA' new uid was assigned .05, parent uid .02
[cache ][4123608.05]     => no NSEC* cached for zone: esamsungchina.com.cn.
[cache ][4123608.05]     => skipping zone: esamsungchina.com.cn., NSEC, hash 0;new TTL -123456789, ret -2
[cache ][4123608.05]     => skipping zone: esamsungchina.com.cn., NSEC, hash 0;new TTL -123456789, ret -2
[select][4123608.05]     => id: '16382' choosing: 'dns1.esamsungchina.com.cn.'@'27.106.204.42#00053' with timeout 10000 ms zone cut: 'esamsungchina.com.cn.'
[resolv][4123608.05]     => id: '16382' querying: 'dns1.esamsungchina.com.cn.'@'27.106.204.42#00053' zone cut: 'esamsungchina.com.cn.' qname: 'DNs1.esamSUNgcHiNA.COM.cn.' qtype: 'AAAA' proto: 'udp'
[select][4123608.05]     => id: '16382' noting selection error: 'dns1.esamsungchina.com.cn.'@'27.106.204.42#00053' zone cut: 'esamsungchina.com.cn.' error: 1 QUERY_TIMEOUT
[worker][4123608.00] internal timeout for resolving the request has expired
[resolv][4123608.00] request failed, answering with empty SERVFAIL
[resolv][4123608.05]     finished in state: 8, queries: 0, mempool: 114752 B

po 19. 9. 2022 o 13:29 Robert Šefr <robert.sefr@whalebone.io> napísal(a):
Hi Blažej,
can you trace the query using this feature? https://knot-resolver.readthedocs.io/en/stable/modules-http-trace.html#using-http-module
This will provide extremely detailed information on why Knot resolver responds with SERVFAIL.

Best regards
Robert

On Mon, Sep 19, 2022 at 1:25 PM Blažej Krajňák <blazej.krajnak@gmail.com> wrote:
Hello everyone,

at AS50242 we experience problem with resolving connectivity.samsung.com.cn
We run two servers, each with 4 instances. Both servers have working
dual-stack (v4/v6).

knot-dnsutils/unknown,now 3.1.1-cznic.1 amd64 [installed]
knot-resolver-module-http/unknown,now 5.5.0-cznic.1 all [installed,automatic]
knot-resolver-release/unknown,now 1.9-1 all [installed]
knot-resolver/unknown,now 5.5.0-cznic.1 amd64 [installed]

Dnsviz shows problem reaching few IPv6 servers of .cn TLD via UDP. I
can not understand, why both of our servers response with SERVFAIL.

Any ideas how to troubleshoot more?

Thank you,
Blažej
--


--
Robert Šefr
CTO
robert.sefr@whalebone.io  |  +420608737930  |  www.whalebone.io
Whalebone, s.r.o.
Jezuitská 14/13, 602 00 Brno
Czech Republic
--