Strange "Invalid DNSSEC signatures" received from widely used public DNS servers #2133
Replies: 15 comments 9 replies
-
|
It seems that there is a round-robin selection of all three dnssec servers defined for , so I guess that's the meaning of the |
Beta Was this translation helpful? Give feedback.
-
|
I confirm that scaleway-fr is experiencing some DNS issue, but I can contact the 2 others without any issue: |
Beta Was this translation helpful? Give feedback.
-
|
Maybe I misinterpreted the meaning of
|
Beta Was this translation helpful? Give feedback.
-
You sent a query, and the server responded with a
There are two main reason for a server to respond with that error code. Either it tried to resolve the query, but upstream servers with the data were not reachable at that time. Or they were, but the response had DNSSEC signatures that were invalid. Check the query log to see what domain names are causing this. Then a tool such as https://zonemaster.net/domain_check can tell you more about what configuration issue these domain names are experiencing. |
Beta Was this translation helpful? Give feedback.
-
|
The query.log is very instructive: DCP continues to try to access |
Beta Was this translation helpful? Give feedback.
-
|
Same issue later on with the other server: |
Beta Was this translation helpful? Give feedback.
-
|
Also, I do not see any DS/DNSKEY records requests despite |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
$ dig PTR 248.26.22.195.in-addr.arpa @4.2.2.2
;; connection timed out; no servers could be reached$ dig PTR 248.26.22.195.in-addr.arpa @8.8.8.8
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 31552
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
|
Beta Was this translation helpful? Give feedback.
-
|
@jedisct1 |
Beta Was this translation helpful? Give feedback.
-
|
The proxy got the correct response from the server, even if it has a That being said, a |
Beta Was this translation helpful? Give feedback.
-
|
@jedisct1 |
Beta Was this translation helpful? Give feedback.
-
|
See https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Load-Balancing-Options for a description of how load balancing works. |
Beta Was this translation helpful? Give feedback.
-
|
Now, nothing is said in your Tthis answer could mean for DCP:
DCP cannot determine with certainty which one is the cause for this error, so the correct behavior would be to try the next best available server, until one server among all reachable servers answers something else than SERVFAIL You cannot have both behaviors. |
Beta Was this translation helpful? Give feedback.
-
|
It is a very decent strategy. https://www.eecs.harvard.edu/~michaelm/postscripts/handbook2001.pdf |
Beta Was this translation helpful? Give feedback.
-
|
@jean-christophe-manciot @jedisct1 edit: |
Beta Was this translation helpful? Give feedback.
-
|
@jedisct1 I can see several cases involving a failed answer:
I find it very surprising that a server would return the same SERVFAIL for two very different situations, making DCP unable to distinguish between them and unable to take 2 different actions. As a conclusion, unless DCP finds a way to distinguish between the 2, DCP must try another server from It may have something to do with some of the LB algorithms though, namely the p2, ph and random, but it shoud never be used when something goes wrong, i.e when one of the 3 failed situations happens. @livingentity |
Beta Was this translation helpful? Give feedback.
-
|
SERVFAIL IS A VALID RESPONSE IT DOESN'T MEAN THAT THE DOH/ODOH/DNSCRYPT SERVER EXPERIENCED A FAILURE. The log message needs to be changed not to mention |
Beta Was this translation helpful? Give feedback.
-
|
@jean-christophe-manciot |
Beta Was this translation helpful? Give feedback.
-
|
Once again, |
Beta Was this translation helpful? Give feedback.
-
|
Some of my thoughts:
I think here we made a variant: the servers are ranked, so we don't pick the better 1 from 2 totally randoms. Let's review the whole model:
If the stability (fast or slow) of all servers are:
I know some other DNS proxy has an option So, you can see there is Proposed standard rfc8914 ... |
Beta Was this translation helpful? Give feedback.
-
|
@lifenjoiner
This is perfect :-). I know that it will take some time until all DNS resolvers support it, but we can expect the major ones (QUAD9, cloudflare, Google....) to support it soon enough; maybe they already do. |
Beta Was this translation helpful? Give feedback.
-
Output of the following commands:
./dnscrypt-proxy -version
./dnscrypt-proxy -check
./dnscrypt-proxy -resolve example.com
What is affected by this bug?
?
When does this occur?
sporadically
Where does it happen?
paris, france
How do we replicate the issue?
Ubuntu jammy
ISP not supporting IPv6.
dnscrypt-proxy.toml:
Suddenly, some servers experience loss of connectivity with some
strangeUpdating stamp:Other Comments
I don't experience any issue pinging them:
And I find it very hard to believe that suddenly all those widely used DNS servers return invalid DNSSEC signatures.
Either:
experiencing connectivity issues.Is someone experiencing the same situation?
Beta Was this translation helpful? Give feedback.
All reactions