• broken trust chain

    From Youssef.FassiFihri@Youssef.FassiFihri@inwi.ma to bind-users on Tue Jul 28 23:10:25 2020
    From Newsgroup: comp.protocols.dns.bind

    --_000_6dac61267286414c979b7ab501647acdinwima_
    Content-Type: text/plain; charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable

    Hi All,


    I am using Bind as resolver for end users .


    At various time, bind logs show "broken trust chain" continuously , for ab= out 20mn ~ 30 mn causing an increase of "recursive clients" shown in "rndc=
    status" and a decrease of "DNS sucess rate KPI" supervised from end users=
    side. then the error disappear and everything is OK.


    the problem appears on different server at different time.


    What could be the problem?


    Regards,

    ________________________________

    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de conten=
    ir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne doiv= ent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L'in= t=E9grit=E9 des messages =E9lectroniques n'=E9tant pas garantie, WANA CORPO= RATE d=E9cline toute responsabilit=E9 dans le cas o=F9 ce message aurait = =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. Si = vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l'exp=E9di= teur et le d=E9truire y compris les pi=E8ces jointes.

    Merci. =BB

    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -----------------------

    =AB This message and its attachments may contain confidential or privileged=
    information that should not be copied, distributed or used without authori= zation. As the integrity of emails may not be guaranteed, WANA CORPORATE is=
    not liable for messages that have been modified, changed or falsified.

    If you have received this email in error, please notify the sender and dele=
    te this message and its attachments.

    Thank you. =BB


    --_000_6dac61267286414c979b7ab501647acdinwima_
    Content-Type: text/html; charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable

    <html>
    <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=

    <style type=3D"text/css" style=3D"display:none;"><!-- P {margin-top:0;margi= n-bottom:0;} --></style>
    </head>
    <body dir=3D"ltr">
    <div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt;color:#000000;font= -family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">
    <p>Hi All,</p>
    <p><br>

    <p>I am using Bind as resolver for end users &nbsp;.</p>
    <p><br>

    <p>At various time, bind logs show &quot;<span>broken trust chain&quot; con= tinuously&nbsp;</span>&nbsp;, for about 20mn&nbsp; ~&nbsp;30 mn causing an = increase of &quot;<span>recursive clients&quot; shown in &quot;rndc status&= quot; and a decrease of&nbsp; &quot;DNS sucess rate KPI&quot; supervised fr=
    om end users side.&nbsp;&nbsp;</span><span style=3D"font-size: 12pt;">then
    the error disappear and everything is OK.</span></p>
    <p><span><br>
    </span></p>
    <p><span>the problem appears on different server at different time.</span><=

    <p><span><br>
    </span></p>
    <p><span>What could be the problem?</span></p>
    <p><span><br>
    </span></p>
    <p><span>Regards,&nbsp;</span></p>
    </div>


    <font face=3D"Arial" color=3D"Gray" size=3D"2"><br>
    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de conten=
    ir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne doiv= ent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L&#8= 217;int=E9grit=E9 des messages =E9lectroniques n&#8217;=E9tant pas
    garantie, WANA CORPORATE d=E9cline toute responsabilit=E9 dans le cas o=F9=
    ce message aurait =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.<br>

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. Si = vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l&#8217;ex= p=E9diteur et le d=E9truire y compris les pi=E8ces jointes.<br>

    Merci. =BB<br>

    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -----------------------<br>

    =AB This message and its attachments may contain confidential or privileged=
    information that should not be copied, distributed or used without authori= zation. As the integrity of emails may not be guaranteed, WANA CORPORATE is=
    not liable for messages that have
    been modified, changed or falsified.<br>

    If you have received this email in error, please notify the sender and dele=
    te this message and its attachments.<br>

    Thank you. =BB<br>

    </font>
    </body>
    </html>

    --_000_6dac61267286414c979b7ab501647acdinwima_--
    --- Synchronet 3.18a-Linux NewsLink 1.113
  • From John W. Blue@john.blue@rrcic.com to bind-users@lists.isc.org on Tue Jul 28 23:30:54 2020
    From Newsgroup: comp.protocols.dns.bind

    --_000_8de7abdfd3de4b668f2d3d7b00bc0811mailrrciccom_
    Content-Type: text/plain; charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable

    What version of BIND are you using?

    John

    From: bind-users [mailto:bind-users-bounces@lists.isc.org] On Behalf Of You= ssef.FassiFihri@inwi.ma
    Sent: Tuesday, July 28, 2020 6:10 PM
    To: bind-users@lists.isc.org
    Subject: broken trust chain


    Hi All,



    I am using Bind as resolver for end users .



    At various time, bind logs show "broken trust chain" continuously , for ab= out 20mn ~ 30 mn causing an increase of "recursive clients" shown in "rndc=
    status" and a decrease of "DNS sucess rate KPI" supervised from end users=
    side. then the error disappear and everything is OK.



    the problem appears on different server at different time.



    What could be the problem?



    Regards,

    ________________________________

    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de conten=
    ir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne doiv= ent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L'in= t=E9grit=E9 des messages =E9lectroniques n'=E9tant pas garantie, WANA CORPO= RATE d=E9cline toute responsabilit=E9 dans le cas o=F9 ce message aurait = =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. Si = vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l'exp=E9di= teur et le d=E9truire y compris les pi=E8ces jointes.

    Merci. =BB

    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -----------------------

    =AB This message and its attachments may contain confidential or privileged=
    information that should not be copied, distributed or used without authori= zation. As the integrity of emails may not be guaranteed, WANA CORPORATE is=
    not liable for messages that have been modified, changed or falsified.

    If you have received this email in error, please notify the sender and dele=
    te this message and its attachments.

    Thank you. =BB

    --_000_8de7abdfd3de4b668f2d3d7b00bc0811mailrrciccom_
    Content-Type: text/html; charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable

    <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40">
    <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=

    <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
    o\:* {behavior:url(#default#VML);}
    w\:* {behavior:url(#default#VML);}
    .shape {behavior:url(#default#VML);}
    </style><![endif]--><style><!--
    /* Font Definitions */
    @font-face
    {font-family:"Cambria Math";
    panose-1:2 4 5 3 5 4 6 3 2 4;}
    @font-face
    {font-family:Calibri;
    panose-1:2 15 5 2 2 2 4 3 2 4;}
    /* Style Definitions */
    p.MsoNormal, li.MsoNormal, div.MsoNormal
    {margin:0in;
    margin-bottom:.0001pt;
    font-size:12.0pt;
    font-family:"Times New Roman","serif";}
    a:link, span.MsoHyperlink
    {mso-style-priority:99;
    color:#0563C1;
    text-decoration:underline;}
    a:visited, span.MsoHyperlinkFollowed
    {mso-style-priority:99;
    color:#954F72;
    text-decoration:underline;}
    p
    {mso-style-priority:99;
    margin:0in;
    margin-bottom:.0001pt;
    font-size:12.0pt;
    font-family:"Times New Roman","serif";}
    span.EmailStyle18
    {mso-style-type:personal-reply;
    font-family:"Calibri","sans-serif";
    color:#1F497D;}
    .MsoChpDefault
    {mso-style-type:export-only;
    font-size:10.0pt;}
    @page WordSection1
    {size:8.5in 11.0in;
    margin:1.0in 1.0in 1.0in 1.0in;}
    div.WordSection1
    {page:WordSection1;}
    </style><!--[if gte mso 9]><xml>
    <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
    </xml><![endif]--><!--[if gte mso 9]><xml>
    <o:shapelayout v:ext=3D"edit">
    <o:idmap v:ext=3D"edit" data=3D"1" />
    </o:shapelayout></xml><![endif]-->
    </head>
    <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
    <div class=3D"WordSection1">
    <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca= libri&quot;,&quot;sans-serif&quot;;color:#1F497D">What version of BIND are = you using?<o:p></o:p></span></p>
    <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca= libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=

    <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca= libri&quot;,&quot;sans-serif&quot;;color:#1F497D">John<o:p></o:p></span></p=

    <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca= libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=

    <div>
    <div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in">
    <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot= ;Calibri&quot;,&quot;sans-serif&quot;">From:</span></b><span style=3D"font-= size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;"> bind-u= sers [mailto:bind-users-bounces@lists.isc.org]
    <b>On Behalf Of </b>Youssef.FassiFihri@inwi.ma<br>
    <b>Sent:</b> Tuesday, July 28, 2020 6:10 PM<br>
    <b>To:</b> bind-users@lists.isc.org<br>
    <b>Subject:</b> broken trust chain<o:p></o:p></span></p>
    </div>
    </div>
    <p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
    <div id=3D"divtagdefaultwrapper">
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black">Hi All,<o:p></o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black"><o:p>&nbsp;</o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black">I am using Bind as resolver for end users &nbsp;.<o:p></o:p></sp= an></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black"><o:p>&nbsp;</o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black">At various time, bind logs show &quot;broken trust chain&quot; c= ontinuously&nbsp;&nbsp;, for about 20mn&nbsp; ~&nbsp;30 mn causing an incre= ase of &quot;recursive clients&quot; shown in &quot;rndc status&quot; and a=
    decrease of&nbsp; &quot;DNS sucess rate
    KPI&quot; supervised from end users side.&nbsp;&nbsp;then the error disapp= ear and everything is OK.<o:p></o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black"><o:p>&nbsp;</o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black">the problem appears on different server at different time.<o:p><= /o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black"><o:p>&nbsp;</o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black">What could be the problem?<o:p></o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black"><o:p>&nbsp;</o:p></span></p>
    <p><span style=3D"font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;co= lor:black">Regards,&nbsp;<o:p></o:p></span></p>
    </div>
    <p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
    <div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center">
    <hr size=3D"2" width=3D"100%" align=3D"center">
    </div>
    <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s= ize:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:gray"= ><br>
    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de conten=
    ir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne doiv= ent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L&#8= 217;int=E9grit=E9 des messages =E9lectroniques n&#8217;=E9tant pas
    garantie, WANA CORPORATE d=E9cline toute responsabilit=E9 dans le cas o=F9=
    ce message aurait =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.<br>

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. Si = vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l&#8217;ex= p=E9diteur et le d=E9truire y compris les pi=E8ces jointes.<br>

    Merci. =BB<br>

    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -----------------------<br>

    =AB This message and its attachments may contain confidential or privileged=
    information that should not be copied, distributed or used without authori= zation. As the integrity of emails may not be guaranteed, WANA CORPORATE is=
    not liable for messages that have
    been modified, changed or falsified.<br>

    If you have received this email in error, please notify the sender and dele=
    te this message and its attachments.<br>

    Thank you. =BB</span><o:p></o:p></p>
    </div>
    </body>
    </html>

    --_000_8de7abdfd3de4b668f2d3d7b00bc0811mailrrciccom_--
    --- Synchronet 3.18a-Linux NewsLink 1.113
  • From Mark Andrews@marka@isc.org to Youssef.FassiFihri on Wed Jul 29 11:15:24 2020
    From Newsgroup: comp.protocols.dns.bind

    A network link that is dropping packets can trigger EDNS failures in versions of
    BIND before 9.13.3. These versions have code to compensate for servers that fail to respond to EDNS queries or fail to respond to EDNS queries with DO=1
    or fail to respond to queries with (particular) EDNS options set. BIND would fallback to plain DNS queries to workaround these issues, but that broke
    DNSSEC when the answers where coming from a signed zone and the packet loss
    is due to network issues.
    5029. [func] Workarounds for servers that misbehave when queried
    with EDNS have been removed, because these broken
    servers and the workarounds for their noncompliance
    cause unnecessary delays, increase code complexity,
    and prevent deployment of new DNS features. See
    https://dnsflagday.net for further details. [GL #150]
    On 29 Jul 2020, at 09:10, <Youssef.FassiFihri@inwi.ma> <Youssef.FassiFihri@inwi.ma> wrote:

    Hi All,

    I am using Bind as resolver for end users .

    At various time, bind logs show "broken trust chain" continuously , for about 20mn ~ 30 mn causing an increase of "recursive clients" shown in "rndc status" and a decrease of "DNS sucess rate KPI" supervised from end users side. then the error disappear and everything is OK.

    the problem appears on different server at different time.

    What could be the problem?

    Regards,


    « Ce message et toutes les pièces y jointes sont susceptibles de contenir des informations confidentielles ou privilégiées, lesquelles ne doivent être reproduites, diffusées ou exploitées sans autorisation. L’intégrité des messages électroniques n’étant pas garantie, WANA CORPORATE décline toute responsabilité dans le cas où ce message aurait été altéré, déformé ou falsifié.

    Ce message est établi à l'attention exclusive de ses destinataires. Si vous avez reçu ce message par erreur, veuillez le signaler à l’expéditeur et le détruire y compris les pièces jointes.

    Merci. »

    --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    « This message and its attachments may contain confidential or privileged information that should not be copied, distributed or used without authorization. As the integrity of emails may not be guaranteed, WANA CORPORATE is not liable for messages that have been modified, changed or falsified.

    If you have received this email in error, please notify the sender and delete this message and its attachments.

    Thank you. »

    _______________________________________________
    Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

    ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


    bind-users mailing list
    bind-users@lists.isc.org
    https://lists.isc.org/mailman/listinfo/bind-users
    --
    Mark Andrews, ISC
    1 Seymour St., Dundas Valley, NSW 2117, Australia
    PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
    --- Synchronet 3.18a-Linux NewsLink 1.113
  • From Youssef.FassiFihri@Youssef.FassiFihri@inwi.ma to marka on Wed Jul 29 10:31:19 2020
    From Newsgroup: comp.protocols.dns.bind

    --_000_5018dc929e8043cb885c1ad55bfc560cinwima_
    Content-Type: text/plain; charset="Windows-1252"
    Content-Transfer-Encoding: quoted-printable

    Thank you, Andrews.


    ________________________________
    De : Mark Andrews <marka@isc.org>
    Envoy=E9 : mercredi 29 juillet 2020 02:15:24
    =C0 : Youssef Fassi Fihri
    Cc : bind-users@lists.isc.org
    Objet : Re: broken trust chain

    A network link that is dropping packets can trigger EDNS failures in versio=
    ns of
    BIND before 9.13.3. These versions have code to compensate for servers tha=
    t
    fail to respond to EDNS queries or fail to respond to EDNS queries with DO= =3D1
    or fail to respond to queries with (particular) EDNS options set. BIND woul=
    d
    fallback to plain DNS queries to workaround these issues, but that broke
    DNSSEC when the answers where coming from a signed zone and the packet loss
    is due to network issues.

    5029. [func] Workarounds for servers that misbehave when queried
    with EDNS have been removed, because these broken
    servers and the workarounds for their noncompliance
    cause unnecessary delays, increase code complexity,
    and prevent deployment of new DNS features. See
    https://dnsflagday.net for further details. [GL #15=
    0]


    On 29 Jul 2020, at 09:10, <Youssef.FassiFihri@inwi.ma> <Youssef.FassiFihr=
    i@inwi.ma> wrote:

    Hi All,

    I am using Bind as resolver for end users .

    At various time, bind logs show "broken trust chain" continuously , for =
    about 20mn ~ 30 mn causing an increase of "recursive clients" shown in "rn=
    dc status" and a decrease of "DNS sucess rate KPI" supervised from end use=
    rs side. then the error disappear and everything is OK.

    the problem appears on different server at different time.

    What could be the problem?

    Regards,


    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de cont=
    enir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne do= ivent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L= =92int=E9grit=E9 des messages =E9lectroniques n=92=E9tant pas garantie, WAN=
    A CORPORATE d=E9cline toute responsabilit=E9 dans le cas o=F9 ce message au= rait =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. S=
    i vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l=92exp= =E9diteur et le d=E9truire y compris les pi=E8ces jointes.

    Merci. =BB

    -------------------------------------------------------------------------=
    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -------------------------

    =AB This message and its attachments may contain confidential or privileg=
    ed information that should not be copied, distributed or used without autho= rization. As the integrity of emails may not be guaranteed, WANA CORPORATE =
    is not liable for messages that have been modified, changed or falsified.

    If you have received this email in error, please notify the sender and de=
    lete this message and its attachments.

    Thank you. =BB

    _______________________________________________
    Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubsc=
    ribe from this list

    ISC funds the development of this software with paid support subscription=
    s. Contact us at https://www.isc.org/contact/ for more information.


    bind-users mailing list
    bind-users@lists.isc.org
    https://lists.isc.org/mailman/listinfo/bind-users

    --
    Mark Andrews, ISC
    1 Seymour St., Dundas Valley, NSW 2117, Australia
    PHONE: +61 2 9871 4742 INTERNET: marka@isc.org


    ________________________________

    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de conten=
    ir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne doiv= ent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L=92= int=E9grit=E9 des messages =E9lectroniques n=92=E9tant pas garantie, WANA C= ORPORATE d=E9cline toute responsabilit=E9 dans le cas o=F9 ce message aurai=
    t =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. Si = vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l=92exp=E9= diteur et le d=E9truire y compris les pi=E8ces jointes.

    Merci. =BB

    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -----------------------

    =AB This message and its attachments may contain confidential or privileged=
    information that should not be copied, distributed or used without authori= zation. As the integrity of emails may not be guaranteed, WANA CORPORATE is=
    not liable for messages that have been modified, changed or falsified.

    If you have received this email in error, please notify the sender and dele=
    te this message and its attachments.

    Thank you. =BB


    --_000_5018dc929e8043cb885c1ad55bfc560cinwima_
    Content-Type: text/html; charset="Windows-1252"
    Content-Transfer-Encoding: quoted-printable

    <html>
    <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252">
    <meta name=3D"Generator" content=3D"Microsoft Exchange Server">
    <!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; pad= ding-left: 4pt; border-left: #800000 2px solid; } --></style>
    </head>
    <body>
    <meta content=3D"text/html; charset=3DUTF-8">
    <style type=3D"text/css" style=3D"">
    <!--
    p
    {margin-top:0;
    margin-bottom:0}

    </style>
    <div dir=3D"ltr">
    <div id=3D"x_divtagdefaultwrapper" dir=3D"ltr" style=3D"font-size:12pt; col= or:#000000; font-family:Calibri,Helvetica,sans-serif">
    <p>Thank you,&nbsp; Andrews.<br>

    <p><br>

    </div>
    <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%">
    <div id=3D"x_divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" = color=3D"#000000" style=3D"font-size:11pt"><b>De :</b> Mark Andrews &lt;mar= ka@isc.org&gt;<br>
    <b>Envoy=E9 :</b> mercredi 29 juillet 2020 02:15:24<br>
    <b>=C0 :</b> Youssef Fassi Fihri<br>
    <b>Cc&nbsp;:</b> bind-users@lists.isc.org<br>
    <b>Objet :</b> Re: broken trust chain</font>
    <div>&nbsp;</div>
    </div>
    </div>
    <font size=3D"2"><span style=3D"font-size:10pt;">
    <div class=3D"PlainText">A network link that is dropping packets can trigge=
    r EDNS failures in versions of<br>
    BIND before 9.13.3.&nbsp; These versions have code to compensate for server=
    s that<br>
    fail to respond to EDNS queries or fail to respond to EDNS queries with DO= =3D1<br>
    or fail to respond to queries with (particular) EDNS options set. BIND woul= d<br>
    fallback to plain DNS queries to workaround these issues, but that broke<br=

    DNSSEC when the answers where coming from a signed zone and the packet loss=

    is due to network issues.<br>

    5029.&nbsp;&nbsp; [func]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb= sp; Workarounds for servers that misbehave when queried<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb= sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; with EDNS h= ave been removed, because these broken<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb= sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; servers and=
    the workarounds for their noncompliance<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb= sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cause unnec= essary delays, increase code complexity,<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb= sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; and prevent=
    deployment of new DNS features. See<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb= sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=3D"= https://dnsflagday.net">https://dnsflagday.net</a> for further details. [GL=
    #150]<br>


    &gt; On 29 Jul 2020, at 09:10, &lt;Youssef.FassiFihri@inwi.ma&gt; &lt;Youss= ef.FassiFihri@inwi.ma&gt; wrote:<br>
    &gt; <br>
    &gt; Hi All,<br>
    &gt; <br>
    &gt; I am using Bind as resolver for end users&nbsp; .<br>
    &gt; <br>
    &gt; At various time, bind logs show &quot;broken trust chain&quot; continu= ously&nbsp; , for about 20mn&nbsp; ~ 30 mn causing an increase of &quot;rec= ursive clients&quot; shown in &quot;rndc status&quot; and a decrease of&nbs=
    p; &quot;DNS sucess rate KPI&quot; supervised from end users side.&nbsp; th=
    en the error disappear
    and everything is OK.<br>
    &gt; <br>
    &gt; the problem appears on different server at different time.<br>
    &gt; <br>
    &gt; What could be the problem?<br>
    &gt; <br>
    &gt; Regards, <br>
    &gt; <br>
    &gt; <br>
    &gt; =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de c= ontenir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne=
    doivent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation.=
    L=92int=E9grit=E9 des messages =E9lectroniques n=92=E9tant pas
    garantie, WANA CORPORATE d=E9cline toute responsabilit=E9 dans le cas o=F9=
    ce message aurait =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.<br>
    &gt; <br>
    &gt; Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires=
    . Si vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l=92e= xp=E9diteur et le d=E9truire y compris les pi=E8ces jointes.<br>
    &gt; <br>
    &gt; Merci. =BB<br>
    &gt; <br>
    &gt; ----------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ----------------------------<br>
    &gt; <br>
    &gt; =AB This message and its attachments may contain confidential or privi= leged information that should not be copied, distributed or used without au= thorization. As the integrity of emails may not be guaranteed, WANA CORPORA=
    TE is not liable for messages that have
    been modified, changed or falsified.<br>
    &gt; <br>
    &gt; If you have received this email in error, please notify the sender and=
    delete this message and its attachments.<br>
    &gt; <br>
    &gt; Thank you. =BB<br>
    &gt; <br>
    &gt; _______________________________________________<br>
    &gt; Please visit <a href=3D"https://lists.isc.org/mailman/listinfo/bind-us= ers">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe f= rom this list<br>
    &gt; <br>
    &gt; ISC funds the development of this software with paid support subscript= ions. Contact us at
    <a href=3D"https://www.isc.org/contact/">https://www.isc.org/contact/</a> f=
    or more information.<br>
    &gt; <br>
    &gt; <br>
    &gt; bind-users mailing list<br>
    &gt; bind-users@lists.isc.org<br>
    &gt; <a href=3D"https://lists.isc.org/mailman/listinfo/bind-users">https://= lists.isc.org/mailman/listinfo/bind-users</a><br>

    -- <br>
    Mark Andrews, ISC<br>
    1 Seymour St., Dundas Valley, NSW 2117, Australia<br>
    PHONE: &#43;61 2 9871 4742&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&= nbsp;&nbsp;&nbsp;&nbsp;&nbsp; INTERNET: marka@isc.org<br>

    </div>
    </span></font><br>

    <font face=3D"Arial" color=3D"Gray" size=3D"2"><br>
    =AB Ce message et toutes les pi=E8ces y jointes sont susceptibles de conten=
    ir des informations confidentielles ou privil=E9gi=E9es, lesquelles ne doiv= ent =EAtre reproduites, diffus=E9es ou exploit=E9es sans autorisation. L=92= int=E9grit=E9 des messages =E9lectroniques n=92=E9tant pas
    garantie, WANA CORPORATE d=E9cline toute responsabilit=E9 dans le cas o=F9=
    ce message aurait =E9t=E9 alt=E9r=E9, d=E9form=E9 ou falsifi=E9.<br>

    Ce message est =E9tabli =E0 l'attention exclusive de ses destinataires. Si = vous avez re=E7u ce message par erreur, veuillez le signaler =E0 l=92exp=E9= diteur et le d=E9truire y compris les pi=E8ces jointes.<br>

    Merci. =BB<br>

    ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= -----------------------<br>

    =AB This message and its attachments may contain confidential or privileged=
    information that should not be copied, distributed or used without authori= zation. As the integrity of emails may not be guaranteed, WANA CORPORATE is=
    not liable for messages that have
    been modified, changed or falsified.<br>

    If you have received this email in error, please notify the sender and dele=
    te this message and its attachments.<br>

    Thank you. =BB<br>

    </font>
    </body>
    </html>

    --_000_5018dc929e8043cb885c1ad55bfc560cinwima_--
    --- Synchronet 3.18a-Linux NewsLink 1.113