9 May
2023
9 May
'23
11:05 p.m.
Hoping someone can help...
Built Knot Resolver v5.6.0 from source.
It works and resolves correctly for "regular" TLDs.
However, I would like to point it to OpenNIC for resolution /forwarding
so that I can resolve the expanded /alternative TLDs.
Default configuration with:
policy.add(policy.all(
policy.FORWARD(
{'2001:19f0:b001:379:5400:3ff:fe68:1cc6',
'138.197.140.189',
'2600:3c04::f03c:93ff:febd:be27',
'45.61.49.203'})))
and it fails to find "grep.geek" using the standard root zone /hints:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22871
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;grep.geek. IN A
;; AUTHORITY SECTION:
. 86077 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 2023050902 1800 900 604800 86400
So I checked the Documentation site and found "hints.root" which
theoretically will override any other root hints.
Using the OpenNIC root zone file (downloads as "db.root") I set:
hints.root ({
['ns13.opennic.glue.'] = { '2a01:4f8:192:43a5::2',
'144.76.103.143' }
})
in kresd.conf.
Still no joy - "grep.geek" is NXDOMAIN from a.root-servers.net again.
Any thoughts? Things I might have missed along the way?
10 May
10 May
7:46 a.m.
Hi, Ed.
This looks to me like Knot Resolver is not pointed to the same
configuration file you are editing since your changes are not taking
effect at all. The 'hints.root()' function really should replace the
default root hints, which it does not seem to be doing in your case. How
exactly are you running Knot Resolver? Are you pointing it to the
correct 'kresd.conf' file?
Also, your first attempt with 'policy' would not work because
'policy.FORWARD' expects the provided addresses to be resolvers, but the
OpenNIC root servers are authoritative.
Using 'hints.root' is correct, BUT it is not enough to only set that.
You will run into SERVFAILs because you also need to set the correct
DNSSEC trust anchors [1], which Knot Resolver verifies. You will need
the correct keys from OpenNIC root servers [2].
[1]
https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html#trust_anc…
[2] https://wiki.opennic.org/opennic/dnssec
On 09. 05. 23 23:05, Ed V. wrote:
Hoping someone can help...
Built Knot Resolver v5.6.0 from source.
It works and resolves correctly for "regular" TLDs.
However, I would like to point it to OpenNIC for resolution /forwarding
so that I can resolve the expanded /alternative TLDs.
Default configuration with:
policy.add(policy.all(
policy.FORWARD(
{'2001:19f0:b001:379:5400:3ff:fe68:1cc6',
'138.197.140.189',
'2600:3c04::f03c:93ff:febd:be27',
'45.61.49.203'})))
and it fails to find "grep.geek" using the standard root zone /hints:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22871
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;grep.geek. IN A
;; AUTHORITY SECTION:
. 86077 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 2023050902 1800 900 604800 86400
So I checked the Documentation site and found "hints.root" which
theoretically will override any other root hints.
Using the OpenNIC root zone file (downloads as "db.root") I set:
hints.root ({
['ns13.opennic.glue.'] = { '2a01:4f8:192:43a5::2',
'144.76.103.143' }
})
in kresd.conf.
Still no joy - "grep.geek" is NXDOMAIN from a.root-servers.net again.
Any thoughts? Things I might have missed along the way?
--
3:49 p.m.
Oto:
I double-checked just to be sure (with a default build + install
sometimes things can go wrong...).
Whether I run via systemd:
ExecStart=/usr/sbin/kresd -c
/usr/lib/aarch64-linux-gnu/knot-resolver/distro-preconfig.lua -c
/etc/knot-resolver/kresd.conf -n
or by command line, I am explicitly calling the kresd.conf where I have
my changes.
I added DNSKEY's (thank you for that pointer - I would have missed it)
and they work:
$ dig @127.0.1.1 pir.org +dnssec +multi
; <<>> DiG 9.16.37-Debian <<>> @127.0.1.1 pir.org +dnssec +multi ;
(1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16985
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;pir.org. IN A
;; ANSWER SECTION:
pir.org. 300 IN A 34.74.232.240
pir.org. 300 IN RRSIG A 5 2 300 (
20230524084004 20230510084004 56958
pir.org. NGT9ammi8eyXDKJ1YqMaSTnas1FM6foabFmb30GDyklP
dIYsIbLmfP2evYc5Izn/SJdCN/RmWBJozGmPk+kAfv0U
7YEoKBcbRxIeQiDtg8D0Nsl98Do/R7CsaXLVAkC+k8Ed
vnNhnDYo+mn0xAOTOWGPQN/2MoSxYJkcPRcINeo=
)
;; Query time: 627 msec
;; SERVER: 127.0.1.1(127.0.1.1)
;; WHEN: Wed May 10 08:35:34 CDT 2023
;; MSG SIZE rcvd: 219
But I'm still getting the "a.name-servers.net" NXDOMAIN on trying to
resolve 'grep.geek':
$ dig @127.0.1.1 grep.geek +dnssec +multi
; <<>> DiG 9.16.37-Debian <<>> @127.0.1.1 grep.geek +dnssec +multi
-p
53001 ; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 29189
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;grep.geek. IN A
;; AUTHORITY SECTION:
. 24985 IN SOA a.root-servers.net.
nstld.verisign-grs.com. (
[trimmed]
I even moved the default 'root.hints' file out of /etc/knot-resolver
just to make sure it wasn't being called somehow (and checked the
/var/lib and /var/cache folders as well).
Still getting the NX from a.root-servers.net as above.
I'm stumped...
--
Ed V.
On Wed, 10 May 2023 07:46:16 +0200
Oto Šťáva <oto.stava(a)nic.cz> wrote:
Hi, Ed.
This looks to me like Knot Resolver is not pointed to the same
configuration file you are editing since your changes are not taking
effect at all. The 'hints.root()' function really should replace the
default root hints, which it does not seem to be doing in your case.
How exactly are you running Knot Resolver? Are you pointing it to the
correct 'kresd.conf' file?
Also, your first attempt with 'policy' would not work because
'policy.FORWARD' expects the provided addresses to be resolvers, but
the OpenNIC root servers are authoritative.
Using 'hints.root' is correct, BUT it is not enough to only set that.
You will run into SERVFAILs because you also need to set the correct
DNSSEC trust anchors [1], which Knot Resolver verifies. You will need
the correct keys from OpenNIC root servers [2].
[1]
https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html#trust_anc…
[2] https://wiki.opennic.org/opennic/dnssec
On 09. 05. 23 23:05, Ed V. wrote:
Hoping someone can help...
Built Knot Resolver v5.6.0 from source.
It works and resolves correctly for "regular" TLDs.
However, I would like to point it to OpenNIC for resolution
/forwarding so that I can resolve the expanded /alternative TLDs.
Default configuration with:
policy.add(policy.all(
policy.FORWARD(
{'2001:19f0:b001:379:5400:3ff:fe68:1cc6',
'138.197.140.189',
'2600:3c04::f03c:93ff:febd:be27',
'45.61.49.203'})))
and it fails to find "grep.geek" using the standard root zone
/hints:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22871
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1,
ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;grep.geek. IN A
;; AUTHORITY SECTION:
. 86077 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 2023050902 1800 900 604800 86400
So I checked the Documentation site and found "hints.root" which
theoretically will override any other root hints.
Using the OpenNIC root zone file (downloads as "db.root") I set:
hints.root ({
['ns13.opennic.glue.'] = { '2a01:4f8:192:43a5::2',
'144.76.103.143' } })
in kresd.conf.
Still no joy - "grep.geek" is NXDOMAIN from a.root-servers.net
again.
Any thoughts? Things I might have missed along the way?
--
--
3:54 p.m.
Oto:
Second follow-up, I did catch that 'policy.FORWARD' goof and repointed
to the first two IPv4 and IPv6 servers that show up with the
"auto-detect" homepage of https://www.opennic.org
So:
policy.add(policy.all(
policy.FORWARD(
{'2001:19f0:b001:379:5400:3ff:fe68:1cc6',
'138.197.140.189',
'2600:3c04::f03c:93ff:febd:be27',
'45.61.49.203'})))
If I dig directly at one of those servers, 'grep.geek' resolves:
$ dig @138.197.140.189 grep.geek +short
161.97.219.84
If I dig with knot-resolver - NXDOMAIN.
--
Ed V.
On Wed, 10 May 2023 07:46:16 +0200
Oto Šťáva <oto.stava(a)nic.cz> wrote:
Hi, Ed.
This looks to me like Knot Resolver is not pointed to the same
configuration file you are editing since your changes are not taking
effect at all. The 'hints.root()' function really should replace the
default root hints, which it does not seem to be doing in your case.
How exactly are you running Knot Resolver? Are you pointing it to the
correct 'kresd.conf' file?
Also, your first attempt with 'policy' would not work because
'policy.FORWARD' expects the provided addresses to be resolvers, but
the OpenNIC root servers are authoritative.
Using 'hints.root' is correct, BUT it is not enough to only set that.
You will run into SERVFAILs because you also need to set the correct
DNSSEC trust anchors [1], which Knot Resolver verifies. You will need
the correct keys from OpenNIC root servers [2].
[1]
https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html#trust_anc…
[2] https://wiki.opennic.org/opennic/dnssec
On 09. 05. 23 23:05, Ed V. wrote:
Hoping someone can help...
Built Knot Resolver v5.6.0 from source.
It works and resolves correctly for "regular" TLDs.
However, I would like to point it to OpenNIC for resolution
/forwarding so that I can resolve the expanded /alternative TLDs.
Default configuration with:
policy.add(policy.all(
policy.FORWARD(
{'2001:19f0:b001:379:5400:3ff:fe68:1cc6',
'138.197.140.189',
'2600:3c04::f03c:93ff:febd:be27',
'45.61.49.203'})))
and it fails to find "grep.geek" using the standard root zone
/hints:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22871
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1,
ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;grep.geek. IN A
;; AUTHORITY SECTION:
. 86077 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 2023050902 1800 900 604800 86400
So I checked the Documentation site and found "hints.root" which
theoretically will override any other root hints.
Using the OpenNIC root zone file (downloads as "db.root") I set:
hints.root ({
['ns13.opennic.glue.'] = { '2a01:4f8:192:43a5::2',
'144.76.103.143' } })
in kresd.conf.
Still no joy - "grep.geek" is NXDOMAIN from a.root-servers.net
again.
Any thoughts? Things I might have missed along the way?
--
--
4:34 p.m.
Oto:
Third follow-up.
Just for completeness, I re-compiled with:
-Dmanaged_ta=disabled
-Dkeyfile_default=/var/lib/opennic/opennic.keys
-Droot_hints=/var/lib/opennic/db.root
With file content as per the DNSSEC and Local BIND wiki pages.
https://wiki.opennic.org/opennic/t2hints
https://wiki.opennic.org/opennic/dnssec
On restart after fresh install, I see:
kresd[653620]: [taupd ] active refresh failed, update your trust
anchors in "/var/lib/opennic/opennic.keys"
in the systemd status.
Does this mean knot-resolver is trying to manage the ta even though I
explicitly turned that off??
And I still fail to resolve grep.geek with a.root-servers.net responding
NXDOMAIN.
--
Ed V.
On Wed, 10 May 2023 07:46:16 +0200
Oto Šťáva <oto.stava(a)nic.cz> wrote:
Hi, Ed.
This looks to me like Knot Resolver is not pointed to the same
configuration file you are editing since your changes are not taking
effect at all. The 'hints.root()' function really should replace the
default root hints, which it does not seem to be doing in your case.
How exactly are you running Knot Resolver? Are you pointing it to the
correct 'kresd.conf' file?
Also, your first attempt with 'policy' would not work because
'policy.FORWARD' expects the provided addresses to be resolvers, but
the OpenNIC root servers are authoritative.
Using 'hints.root' is correct, BUT it is not enough to only set that.
You will run into SERVFAILs because you also need to set the correct
DNSSEC trust anchors [1], which Knot Resolver verifies. You will need
the correct keys from OpenNIC root servers [2].
[1]
https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html#trust_anc…
[2] https://wiki.opennic.org/opennic/dnssec
On 09. 05. 23 23:05, Ed V. wrote:
Hoping someone can help...
Built Knot Resolver v5.6.0 from source.
It works and resolves correctly for "regular" TLDs.
However, I would like to point it to OpenNIC for resolution
/forwarding so that I can resolve the expanded /alternative TLDs.
Default configuration with:
policy.add(policy.all(
policy.FORWARD(
{'2001:19f0:b001:379:5400:3ff:fe68:1cc6',
'138.197.140.189',
'2600:3c04::f03c:93ff:febd:be27',
'45.61.49.203'})))
and it fails to find "grep.geek" using the standard root zone
/hints:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22871
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1,
ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;grep.geek. IN A
;; AUTHORITY SECTION:
. 86077 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 2023050902 1800 900 604800 86400
So I checked the Documentation site and found "hints.root" which
theoretically will override any other root hints.
Using the OpenNIC root zone file (downloads as "db.root") I set:
hints.root ({
['ns13.opennic.glue.'] = { '2a01:4f8:192:43a5::2',
'144.76.103.143' } })
in kresd.conf.
Still no joy - "grep.geek" is NXDOMAIN from a.root-servers.net
again.
Any thoughts? Things I might have missed along the way?
--
-- 
12 May
12 May
1:32 p.m.
Hello.
On 09/05/2023 23.05, Ed V. wrote:
However, I would like to point it to OpenNIC for
resolution /forwarding
so that I can resolve the expanded /alternative TLDs.
OpenNIC is a bad practice, on multiple levels in my opinion, so I'll be
brief around supporting that use case. Anyway, here's a working config:
modules = { 'hints > iterate' }
hints.root({
--https://wiki.opennic.org/opennic/t2hints
['some.opennic.root.'] = { '168.119.153.26' }
})
--[[
Replace the official (ICANN) root DNSSEC trust anchor by OpenNIC's.
BEWARE: this gives OpenNIC power to spoof *all* names, not just in the newly added
TLDs.
Current DS can be obtained as mentioned onhttps://wiki.opennic.org/opennic/dnssec
dig @195.201.99.61 . DNSKEY | dnssec-dsfromkey -2 -f - .
--]]
trust_anchors.remove('.')
trust_anchors.add('. IN DS 60820 8 2
A01E33C8E95712E555FA9E6C09921830F3A518E36C5998F4ADBF5570AA86B538')
-- Avoid some mess that I don't want to debug in knot resolver 5.x
trust_anchors.set_insecure({ 'opennic.glue.', 'glue.' })
Well, it's not 100% reliable. I ran into some of their servers that
don't return signatures when they should, so that leads to SERVFAILs.
And don't forget to clear cache when you change to incompatible trust
anchors, e.g. remove the data.mdb file.
Generally it might be better to overlay just the (selected) TLDs.
Current Knot Resolver can do that well only from another resolver (not
auth), e.g.
extraTrees = policy.todnames({'libre', 'null'})
policy.add(policy.suffix(policy.FLAGS({'NO_CACHE'}), extraTrees))
-- select a couple close resolver IPs, e.g. directly onhttps://www.opennic.org
-- for simplicity, we don't validate DNSSEC for those
policy.add(policy.suffix(policy.STUB({'2a00:dcc0:eda:88:245:71:858e:a15'}),
extraTrees))
--Vladimir
1221
days inactive
1224
days old
knot-resolver-users@lists.nic.cz
5 comments
3 participants
participants (3)
-
Ed V. -
Oto Šťáva -
Vladimír Čunát