14 Oct
2020
14 Oct
'20
6:12 p.m.
Hi,
I am using knot-resolver with default configuration in arch linux. I am not
able to resolve some domains (like costco.ca). It works fine with other
resolvers like cloudflare/google. Is there way to debug this?
Thanks,
Bala
14 Oct
14 Oct
7:27 p.m.
Hello.
On 10/14/20 6:12 PM, Balakrishnan Balasubramanian wrote:
I am not able to resolve some domains [...]. Is there
way to debug this?
On a quick try I see no problems with resolving this domain. Generally
it's surest to get a verbose log for the failing request.
https://knot-resolver.readthedocs.io/en/stable/config-logging-monitoring.ht…
--Vladimir
8:09 p.m.
I added verbose() at the end of kresd conf, don't see any verbose output. Is
that the right place to add? Attaching conf and my resolver results.
Thanks,
Bala
On Wednesday, October 14, 2020 1:27:04 PM EDT Vladimír Čunát wrote:
Hello.
On 10/14/20 6:12 PM, Balakrishnan Balasubramanian wrote:
❯ khost -t A costco.ca 1.1.1.1
costco.ca. has IPv4 address 170.167.117.82
❯ khost -t A costco.ca 127.0.0.1
;; WARNING: response timeout for 127.0.0.1@53(UDP)
;; WARNING: response timeout for 127.0.0.1@53(UDP)
;; ERROR: failed to query server 127.0.0.1@53(UDP)
❯ khost -t A google.ca 127.0.0.1
google.ca. has IPv4 address 172.217.165.3
❯ cat /etc/knot-resolver/kresd.conf
-- SPDX-License-Identifier: CC0-1.0
-- vim:syntax=lua:set ts=4 sw=4:
-- Refer to manual: https://knot-resolver.readthedocs.org/en/stable/
-- Network interface configuration
net.listen('127.0.0.1', 53, { kind = 'dns' })
net.listen('127.0.0.1', 853, { kind = 'tls' })
net.listen('::1', 53, { kind = 'dns', freebind = true })
net.listen('::1', 853, { kind = 'tls', freebind = true })
net.listen('172.17.0.1', 53, { kind = 'dns', freebind = true })
-- Load useful modules
modules = {
'hints > iterate', -- Load /etc/hosts and allow custom root hints
'stats', -- Track internal statistics
'predict', -- Prefetch expiring/frequent records
}
-- Cache size
cache.size = 100 * MB
verbose()
❯
I am not able to resolve some domains [...]. Is
there way to debug this?
On a quick try I see no problems with resolving this domain. Generally
it's surest to get a verbose log for the failing request.
https://knot-resolver.readthedocs.io/en/stable/config-logging-monitoring.htm
l#verbose
--Vladimir
8:48 p.m.
Thanks! Got verbose logging. But not sure what is the issue. Attaching logs.
First few lines:
[00000.00][plan] plan 'costco.ca.' type 'A' uid [50260.00]
[50260.00][iter] 'costco.ca.' type 'A' new uid was assigned .01,
parent
uid .00
[50260.01][cach] => skipping exact RR: rank 030 (min. 030), new TTL
-25111268
[50260.01][cach] => no NSEC* cached for zone: costco.ca.
[50260.01][cach] => skipping zone: costco.ca., NSEC, hash 0;new TTL
-123456789, ret -2
[50260.01][cach] => skipping zone: costco.ca., NSEC, hash 0;new TTL
-123456789, ret -2
[50260.01][zcut] found cut: costco.ca. (rank 010 return codes: DS 1,
DNSKEY 1)
[50260.01][resl] => NS is provably without DS, going insecure
And got some malformed response
[50260.04][iter] <= malformed response (parsed 12)
Thanks,
Bala
On Wednesday, October 14, 2020 2:12:46 PM EDT Vladimír Čunát wrote:
On 10/14/20 8:09 PM, Balakrishnan Balasubramanian
wrote:
-- Logs begin at Mon 2020-06-15 10:32:44 EDT. --
Oct 14 14:39:26 zadesk kresd[986850]: [59216.15][iter]
'dmtu.mt.ns.els-gms.att.net.' type 'A' new uid was assigned .16, parent
uid .10
Oct 14 14:39:26 zadesk kresd[986850]: [59216.16][wrkr] canceling query due to exceeded
timeout retries limit of 4
Oct 14 14:39:26 zadesk kresd[986850]: [59216.09][resl] AD: request NOT classified as
SECURE
Oct 14 14:39:26 zadesk kresd[986850]: [59216.16][resl] finished: 8, queries: 1,
mempool: 16400 B
Oct 14 14:39:26 zadesk kresd[986850]: [59216.16][resl] AD: request NOT classified as
SECURE
Oct 14 14:39:26 zadesk kresd[986850]: [59216.23][resl] finished: 8, queries: 2,
mempool: 16400 B
Oct 14 14:39:29 zadesk kresd[986850]: [io] => closing connection to
'99.99.99.130#00053'
Oct 14 14:39:33 zadesk kresd[986850]: [io] => closing connection to
'68.94.156.128#00053'
Oct 14 14:39:34 zadesk kresd[986850]: [io] => closing connection to
'99.99.99.128#00053'
Oct 14 14:39:36 zadesk kresd[986850]: [io] => closing connection to
'68.94.156.130#00053'
Oct 14 14:39:51 zadesk kresd[986850]: [00000.00][plan] plan 'costco.ca.' type
'A' uid [50260.00]
Oct 14 14:39:51 zadesk kresd[986850]: [50260.00][iter] 'costco.ca.' type
'A' new uid was assigned .01, parent uid .00
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][cach] => skipping exact RR: rank 030
(min. 030), new TTL -25111268
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][cach] => no NSEC* cached for zone:
costco.ca.
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][cach] => skipping zone: costco.ca.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][cach] => skipping zone: costco.ca.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][zcut] found cut: costco.ca. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][resl] => NS is provably without DS,
going insecure
Oct 14 14:39:51 zadesk kresd[986850]: [50260.01][plan] plan
'dbru.br.ns.els-gms.att.net.' type 'AAAA' uid [50260.02]
Oct 14 14:39:51 zadesk kresd[986850]: [50260.02][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .03, parent
uid .01
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][cach] => skipping exact RR: rank
030 (min. 000), new TTL -12557500
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][cach] => skipping unfit NS packet:
rank 030, new TTL -12557500
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][cach] => no NSEC* cached for zone:
att.net.
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][zcut] found cut: att.net. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][resl] => NS is provably without
DS, going insecure
Oct 14 14:39:51 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 68.94.156.128,
score 2558
Oct 14 14:39:51 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.130,
score 2457
Oct 14 14:39:51 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 68.94.156.130,
score 2530
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][resl] => id: '31063'
querying: '68.94.156.130#00053' score: 1424 zone cut: 'att.net.' qname:
'ELS-GMs.att.Net.' qtype: 'NS' proto: 'udp'
Oct 14 14:39:51 zadesk kresd[986850]: [50260.03][resl] => id: '31063'
querying: '99.99.99.130#00053' score: 1424 zone cut: 'att.net.' qname:
'ELS-GMs.att.Net.' qtype: 'NS' proto: 'udp'
Oct 14 14:39:52 zadesk kresd[986850]: [50260.03][resl] => id: '31063'
querying: '68.94.156.128#00053' score: 1424 zone cut: 'att.net.' qname:
'ELS-GMs.att.Net.' qtype: 'NS' proto: 'udp'
Oct 14 14:39:52 zadesk kresd[986850]: [50260.03][resl] => id: '31063'
querying: '99.99.99.128#00053' score: 1424 zone cut: 'att.net.' qname:
'ELS-GMs.att.Net.' qtype: 'NS' proto: 'udp'
Oct 14 14:39:53 zadesk kresd[986850]: [00000.00][plan] plan 'costco.ca.' type
'A' uid [50260.00]
Oct 14 14:39:53 zadesk kresd[986850]: [50260.00][iter] 'costco.ca.' type
'A' new uid was assigned .01, parent uid .00
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][cach] => skipping exact RR: rank 030
(min. 030), new TTL -25111270
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][cach] => no NSEC* cached for zone:
costco.ca.
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][cach] => skipping zone: costco.ca.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][cach] => skipping zone: costco.ca.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][zcut] found cut: costco.ca. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][resl] => NS is provably without DS,
going insecure
Oct 14 14:39:53 zadesk kresd[986850]: [50260.01][plan] plan
'dbru.br.ns.els-gms.att.net.' type 'AAAA' uid [50260.02]
Oct 14 14:39:53 zadesk kresd[986850]: [50260.02][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .03, parent
uid .01
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][cach] => skipping exact RR: rank
030 (min. 000), new TTL -12557502
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][cach] => skipping unfit NS packet:
rank 030, new TTL -12557502
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][cach] => no NSEC* cached for zone:
att.net.
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][zcut] found cut: att.net. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][resl] => NS is provably without
DS, going insecure
Oct 14 14:39:53 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.130,
score 2457
Oct 14 14:39:53 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 68.94.156.130,
score 2530
Oct 14 14:39:53 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 68.94.156.128,
score 2558
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][wrkr] => server:
'68.94.156.130#00053' flagged as 'bad'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][wrkr] => server:
'99.99.99.130#00053' flagged as 'bad'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][wrkr] => server:
'68.94.156.128#00053' flagged as 'bad'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][wrkr] => server:
'99.99.99.128#00053' flagged as 'bad'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .04, parent
uid .01
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][resl] => id: '59708'
querying: '68.94.156.128#00053' score: 1424 zone cut: 'att.net.' qname:
'elS-GmS.atT.neT.' qtype: 'NS' proto: 'tcp'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][wrkr] => connecting to:
'68.94.156.128#00053'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.03][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .04, parent
uid .01
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][resl] => id: '16361'
querying: '68.94.156.130#00053' score: 1424 zone cut: 'att.net.' qname:
'ELs-GMs.atT.NET.' qtype: 'NS' proto: 'tcp'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][wrkr] => connecting to:
'68.94.156.130#00053'
Oct 14 14:39:53 zadesk kresd[986850]: [wrkr]=> connected to
'68.94.156.128#00053'
Oct 14 14:39:53 zadesk kresd[986850]: [wrkr]=> connected to
'68.94.156.130#00053'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][iter] <= malformed response
(parsed 12)
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][resl] <= server:
'68.94.156.130' rtt: 69 ms
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .05, parent
uid .01
Oct 14 14:39:53 zadesk kresd[986850]: [50260.05][resl] => id: '09140'
querying: '68.94.156.130#00053' score: 1400 zone cut: 'att.net.' qname:
'dbru.bR.Ns.Els-GMs.Att.neT.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][iter] <= malformed response
(parsed 12)
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][resl] <= server:
'68.94.156.128' rtt: 74 ms
Oct 14 14:39:53 zadesk kresd[986850]: [50260.04][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .05, parent
uid .01
Oct 14 14:39:53 zadesk kresd[986850]: [50260.05][resl] => id: '09140'
querying: '68.94.156.130#00053' score: 1400 zone cut: 'att.net.' qname:
'dbru.bR.Ns.Els-GMs.Att.neT.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:54 zadesk kresd[986850]: [50260.05][resl] => id: '09140'
querying: '68.94.156.130#00053' score: 1400 zone cut: 'att.net.' qname:
'dbru.bR.Ns.Els-GMs.Att.neT.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:54 zadesk kresd[986850]: [50260.05][resl] => id: '09140'
querying: '68.94.156.130#00053' score: 1400 zone cut: 'att.net.' qname:
'dbru.bR.Ns.Els-GMs.Att.neT.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:55 zadesk kresd[986850]: [50260.05][wrkr] => server:
'68.94.156.130#00053' flagged as 'bad'
Oct 14 14:39:55 zadesk kresd[986850]: [50260.05][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .06, parent
uid .01
Oct 14 14:39:55 zadesk kresd[986850]: [50260.06][resl] => id: '42104'
querying: '68.94.156.130#00053' score: 1400 zone cut: 'att.net.' qname:
'DBru.BR.ns.eLS-GmS.att.neT.' qtype: 'AAAA' proto: 'tcp'
Oct 14 14:39:55 zadesk kresd[986850]: [50260.05][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .06, parent
uid .01
Oct 14 14:39:55 zadesk kresd[986850]: [50260.06][resl] => id: '03723'
querying: '68.94.156.130#00053' score: 1400 zone cut: 'att.net.' qname:
'DBRu.bR.Ns.elS-GmS.att.NET.' qtype: 'AAAA' proto: 'tcp'
Oct 14 14:39:55 zadesk kresd[986850]: [50260.06][iter] <= malformed response
(parsed 12)
Oct 14 14:39:55 zadesk kresd[986850]: [50260.06][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .07, parent
uid .01
Oct 14 14:39:55 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.128,
score 2207
Oct 14 14:39:55 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.130,
score 2495
Oct 14 14:39:55 zadesk kresd[986850]: [50260.07][resl] => id: '29053'
querying: '68.94.156.128#00053' score: 1410 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:55 zadesk kresd[986850]: [50260.06][iter] <= malformed response
(parsed 12)
Oct 14 14:39:55 zadesk kresd[986850]: [50260.06][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .07, parent
uid .01
Oct 14 14:39:56 zadesk kresd[986850]: [50260.07][resl] => id: '29053'
querying: '68.94.156.128#00053' score: 1410 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:56 zadesk kresd[986850]: [50260.07][resl] => id: '29053'
querying: '68.94.156.128#00053' score: 1410 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:56 zadesk kresd[986850]: [50260.07][resl] => id: '29053'
querying: '68.94.156.128#00053' score: 1410 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:57 zadesk kresd[986850]: [50260.07][wrkr] => server:
'68.94.156.128#00053' flagged as 'bad'
Oct 14 14:39:57 zadesk kresd[986850]: [50260.07][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .08, parent
uid .01
Oct 14 14:39:57 zadesk kresd[986850]: [50260.08][resl] => id: '02066'
querying: '68.94.156.128#00053' score: 1410 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'tcp'
Oct 14 14:39:57 zadesk kresd[986850]: [50260.07][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .08, parent
uid .01
Oct 14 14:39:57 zadesk kresd[986850]: [50260.08][resl] => id: '49467'
querying: '68.94.156.128#00053' score: 1410 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'tcp'
Oct 14 14:39:57 zadesk kresd[986850]: [50260.08][iter] <= malformed response
(parsed 12)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.08][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .09, parent
uid .01
Oct 14 14:39:57 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 68.94.156.130,
score 2167
Oct 14 14:39:57 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.130,
score 2495
Oct 14 14:39:57 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.128,
score 2207
Oct 14 14:39:57 zadesk kresd[986850]: [50260.09][resl] => id: '60647'
querying: '99.99.99.128#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:57 zadesk kresd[986850]: [50260.08][iter] <= malformed response
(parsed 12)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.08][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .09, parent
uid .01
Oct 14 14:39:57 zadesk kresd[986850]: [50260.09][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.09][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .10, parent
uid .01
Oct 14 14:39:57 zadesk kresd[986850]: [50260.10][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.01][iter] 'costco.ca.' type
'A' new uid was assigned .11, parent uid .00
Oct 14 14:39:57 zadesk kresd[986850]: [50260.11][plan] plan
'dbru.br.ns.els-gms.att.net.' type 'A' uid [50260.12]
Oct 14 14:39:57 zadesk kresd[986850]: [50260.12][iter]
'dbru.br.ns.els-gms.att.net.' type 'A' new uid was assigned .13, parent
uid .11
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][cach] => skipping exact RR: rank
030 (min. 000), new TTL -12557504
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][cach] => skipping unfit NS packet:
rank 030, new TTL -12557506
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][cach] => no NSEC* cached for zone:
att.net.
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][zcut] found cut: att.net. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][resl] => NS is provably without
DS, going insecure
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.13][iter]
'dbru.br.ns.els-gms.att.net.' type 'A' new uid was assigned .14, parent
uid .11
Oct 14 14:39:57 zadesk kresd[986850]: [50260.14][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.11][iter] 'costco.ca.' type
'A' new uid was assigned .15, parent uid .00
Oct 14 14:39:57 zadesk kresd[986850]: [50260.15][resl] => unresolvable NS address,
bailing out (counter: 1)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.15][plan] plan
'dmtu.mt.ns.els-gms.att.net.' type 'AAAA' uid [50260.16]
Oct 14 14:39:57 zadesk kresd[986850]: [50260.16][iter]
'dmtu.mt.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .17, parent
uid .15
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][cach] => skipping exact RR: rank
030 (min. 000), new TTL -12042504
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][cach] => skipping unfit NS packet:
rank 030, new TTL -12042504
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][cach] => no NSEC* cached for zone:
att.net.
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][zcut] found cut: att.net. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][resl] => NS is provably without
DS, going insecure
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.17][iter]
'dmtu.mt.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .18, parent
uid .15
Oct 14 14:39:57 zadesk kresd[986850]: [50260.18][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.15][iter] 'costco.ca.' type
'A' new uid was assigned .19, parent uid .00
Oct 14 14:39:57 zadesk kresd[986850]: [50260.19][plan] plan
'dmtu.mt.ns.els-gms.att.net.' type 'A' uid [50260.20]
Oct 14 14:39:57 zadesk kresd[986850]: [50260.20][iter]
'dmtu.mt.ns.els-gms.att.net.' type 'A' new uid was assigned .21, parent
uid .19
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][cach] => skipping exact RR: rank
030 (min. 000), new TTL -12042501
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][cach] => skipping unfit NS packet:
rank 030, new TTL -12042504
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][cach] => no NSEC* cached for zone:
att.net.
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][cach] => skipping zone: att.net.,
NSEC, hash 0;new TTL -123456789, ret -2
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][zcut] usable NS addresses: 0/1
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][zcut] found cut: att.net. (rank 010
return codes: DS 1, DNSKEY 1)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][resl] => NS is provably without
DS, going insecure
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.21][iter]
'dmtu.mt.ns.els-gms.att.net.' type 'A' new uid was assigned .22, parent
uid .19
Oct 14 14:39:57 zadesk kresd[986850]: [50260.22][resl] => no valid NS left
Oct 14 14:39:57 zadesk kresd[986850]: [50260.19][iter] 'costco.ca.' type
'A' new uid was assigned .23, parent uid .00
Oct 14 14:39:57 zadesk kresd[986850]: [50260.23][resl] => unresolvable NS address,
bailing out (counter: 2)
Oct 14 14:39:57 zadesk kresd[986850]: [50260.23][resl] => no NS with an address
Oct 14 14:39:57 zadesk kresd[986850]: [50260.23][iter] 'costco.ca.' type
'A' new uid was assigned .24, parent uid .00
Oct 14 14:39:57 zadesk kresd[986850]: [50260.24][resl] => no NS with an address
Oct 14 14:39:57 zadesk kresd[986850]: [50260.24][resl] AD: request NOT classified as
SECURE
Oct 14 14:39:57 zadesk kresd[986850]: [50260.24][resl] finished: 8, queries: 5, mempool:
16400 B
Oct 14 14:39:58 zadesk kresd[986850]: [50260.09][resl] => id: '60647'
querying: '99.99.99.130#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:58 zadesk kresd[986850]: [50260.09][resl] => id: '60647'
querying: '68.94.156.130#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:58 zadesk kresd[986850]: [50260.09][resl] => id: '60647'
querying: '99.99.99.128#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:39:59 zadesk kresd[986850]: [50260.09][wrkr] => server:
'99.99.99.128#00053' flagged as 'bad'
Oct 14 14:39:59 zadesk kresd[986850]: [50260.09][wrkr] => server:
'99.99.99.130#00053' flagged as 'bad'
Oct 14 14:39:59 zadesk kresd[986850]: [50260.09][wrkr] => server:
'68.94.156.130#00053' flagged as 'bad'
Oct 14 14:39:59 zadesk kresd[986850]: [50260.09][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .10, parent
uid .01
Oct 14 14:39:59 zadesk kresd[986850]: [50260.10][resl] => id: '57881'
querying: '99.99.99.128#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'tcp'
Oct 14 14:39:59 zadesk kresd[986850]: [50260.10][wrkr] => connecting to:
'99.99.99.128#00053'
Oct 14 14:39:59 zadesk kresd[986850]: [wrkr]=> connected to
'99.99.99.128#00053'
Oct 14 14:40:00 zadesk kresd[986850]: [50260.10][iter] <= malformed response
(parsed 12)
Oct 14 14:40:00 zadesk kresd[986850]: [50260.10][iter]
'dbru.br.ns.els-gms.att.net.' type 'AAAA' new uid was assigned .11, parent
uid .01
Oct 14 14:40:00 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 68.94.156.130,
score 2350
Oct 14 14:40:00 zadesk kresd[986850]: [ ][nsre] probing timeouted NS: 99.99.99.130,
score 2514
Oct 14 14:40:00 zadesk kresd[986850]: [50260.11][resl] => id: '20662'
querying: '99.99.99.130#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:40:00 zadesk kresd[986850]: [50260.11][resl] => id: '20662'
querying: '68.94.156.130#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:40:00 zadesk kresd[986850]: [50260.11][resl] => id: '20662'
querying: '99.99.99.130#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:40:00 zadesk kresd[986850]: [50260.11][resl] => id: '20662'
querying: '68.94.156.130#00053' score: 1424 zone cut: 'att.net.' qname:
'dbru.br.ns.els-gms.att.net.' qtype: 'AAAA' proto: 'udp'
Oct 14 14:40:02 zadesk kresd[986850]: [50260.11][wrkr] => server:
'99.99.99.130#00053' flagged as 'bad'
Oct 14 14:40:02 zadesk kresd[986850]: [50260.11][wrkr] => server:
'68.94.156.130#00053' flagged as 'bad'
Oct 14 14:40:02 zadesk kresd[986850]: [50260.00][resl] request failed, answering with
empty SERVFAIL
Oct 14 14:40:02 zadesk kresd[986850]: [50260.11][resl] finished: 8, queries: 0,
mempool: 16400 B
Oct 14 14:40:05 zadesk kresd[986850]: [io] => closing connection to
'68.94.156.130#00053'
Oct 14 14:40:07 zadesk kresd[986850]: [io] => closing connection to
'68.94.156.128#00053'
Oct 14 14:40:11 zadesk kresd[986850]: [io] => closing connection to
'99.99.99.128#00053'
I added verbose() at the end of kresd conf,
don't see any verbose output.
Is that the right place to add?
It's the right place but verbose(true) turns it on and verbose(false)
turns it off.
15 Oct
15 Oct
9:06 a.m.
On 10/14/20 8:48 PM, Balakrishnan Balasubramanian wrote:
Thanks! Got verbose logging. But not sure what is the
issue. Attaching logs.
I'm not sure either. It looks like kresd is doing nothing wrong. The
two servers in **.ns.els-gms.att.net. don't appear to reply over UDP at
all and send garbage over TCP. When I query the same IP addresses from
here they reply OK(-ish) and apparently also from other places (like
from other public resolvers or dnsviz.net).
It's possible that something in your network is interfering with the
queries. Overall I suspect the cause will be hard to track down.
--Vladimir
11:51 a.m.
Thanks for checking! For some domains, 'A' record works fine but AAAA record
crashes. May be it has do with some ipv6 issue in my router.
Is there a way to enable a backup resolver only for failed queries? I can see
policy.FORWARD and policy.TLS_FORWARD functions. But I think they forward all
queries, not just the failed ones.
Also is there a way to get all the direct dns queries (excluding name server
ones) without turning on full verbose logging?
Thanks,
Bala
On Thursday, October 15, 2020 3:06:02 AM EDT Vladimír Čunát wrote:
On 10/14/20 8:48 PM, Balakrishnan Balasubramanian
wrote:
Thanks! Got verbose logging. But not sure what is
the issue. Attaching
logs.
I'm not sure either. It looks like kresd is doing nothing wrong. The
two servers in **.ns.els-gms.att.net. don't appear to reply over UDP at
all and send garbage over TCP. When I query the same IP addresses from
here they reply OK(-ish) and apparently also from other places (like
from other public resolvers or dnsviz.net).
It's possible that something in your network is interfering with the
queries. Overall I suspect the cause will be hard to track down.
--Vladimir 
12:02 p.m.
On 15. 10. 20 11:51, Balakrishnan Balasubramanian wrote:
Thanks for checking! For some domains, 'A'
record works fine but AAAA record
crashes. May be it has do with some ipv6 issue in my router.
As far as I can tell from verbose log here
https://debug.knot-resolver.cz/query.py?qname=mail.smtp2go.com&qtype=AA…
this domain does not have AAAA records so the answer seems to be correct.
Is there a way to enable a backup resolver only for
failed queries? I can see
policy.FORWARD and policy.TLS_FORWARD functions. But I think they forward all
queries, not just the failed ones.
You are right, policy.FORWARD* policies are unconditional. Currently Knot Resolver does
not have this Frankenstein-style feature to combine direct queries with forwarding for a
single request.
Also is there a way to get all the direct dns queries
(excluding name server
ones) without turning on full verbose logging?
I'm not sure what you mean. Maybe
https://knot-resolver.readthedocs.io/en/v5.1.3/modules-policy.html#policy.D…
could help?
Petr Špaček @ CZ.NIC
Thanks,
Bala
On Thursday, October 15, 2020 3:06:02 AM EDT Vladimír Čunát wrote:
> On 10/14/20 8:48 PM, Balakrishnan Balasubramanian wrote:
>> Thanks! Got verbose logging. But not sure what is the issue. Attaching
>> logs.
> I'm not sure either. It looks like kresd is doing nothing wrong. The
> two servers in **.ns.els-gms.att.net. don't appear to reply over UDP at
> all and send garbage over TCP. When I query the same IP addresses from
> here they reply OK(-ish) and apparently also from other places (like
> from other public resolvers or dnsviz.net).
>
> It's possible that something in your network is interfering with the
> queries. Overall I suspect the cause will be hard to track down.
>
> --Vladimir
12:12 p.m.
On 15. 10. 20 12:02, Petr Špaček wrote:
On 15. 10. 20 11:51, Balakrishnan Balasubramanian
wrote:
I'm sorry, I misread attachement in your previous e-mail. You are right, AAAA query
should not fail. Given that it works fine from our test server debug.knot-resolver.cz
linked above I guess it is a local problem.
If you want to dig deeper please provide full verbose log with policy.DEBUG_ALWAYS
enabled. (This policy enables extra extra verbose logging.)
Petr Špaček @ CZ.NIC
Thanks for checking! For some domains,
'A' record works fine but AAAA record
crashes. May be it has do with some ipv6 issue in my router.
As far as I can tell from verbose log here
https://debug.knot-resolver.cz/query.py?qname=mail.smtp2go.com&qtype=AA…
this domain does not have AAAA records so the answer seems to be correct. Is there a way to enable a backup resolver only
for failed queries? I can see
policy.FORWARD and policy.TLS_FORWARD functions. But I think they forward all
queries, not just the failed ones.
You are right, policy.FORWARD* policies are unconditional. Currently Knot Resolver does
not have this Frankenstein-style feature to combine direct queries with forwarding for a
single request.
Also is there a way to get all the direct dns
queries (excluding name server
ones) without turning on full verbose logging?
I'm not sure what you mean. Maybe
https://knot-resolver.readthedocs.io/en/v5.1.3/modules-policy.html#policy.D…
could help?
Petr Špaček @ CZ.NIC
>
> Thanks,
> Bala
>
> On Thursday, October 15, 2020 3:06:02 AM EDT Vladimír Čunát wrote:
>> On 10/14/20 8:48 PM, Balakrishnan Balasubramanian wrote:
>>> Thanks! Got verbose logging. But not sure what is the issue. Attaching
>>> logs.
>> I'm not sure either. It looks like kresd is doing nothing wrong. The
>> two servers in **.ns.els-gms.att.net. don't appear to reply over UDP at
>> all and send garbage over TCP. When I query the same IP addresses from
>> here they reply OK(-ish) and apparently also from other places (like
>> from other public resolvers or dnsviz.net).
>>
>> It's possible that something in your network is interfering with the
>> queries. Overall I suspect the cause will be hard to track down.
>>
>> --Vladimir
1927
days inactive
1928
days old
knot-resolver-users@lists.nic.cz
8 comments
3 participants
participants (3)
-
Balakrishnan Balasubramanian -
Petr Špaček -
Vladimír Čunát