Re: DNSSEC validation broken trust July 22-23rd time.nist.gov
J Doe <[email protected]>
| Newsgroups | gmane.network.dns.bind9.user |
|---|---|
| Message-ID | <e3fb88db-9f68-4e49-b6d5-394367f807fb__16332.4384296843$1753483013$gmane$org@nativemethods.com> |
Hi Julian, Ok, thanks. It slipped my mind to use DNSviz - thank you for mentioning it. - J On 7/24/25 01:19, Julian Panke wrote: > Hi, > > DNSviz is showing the issue very clearly so it was not on your side https://dnsviz.net/d/time.nist.gov/aID54g/dnssec/ > > regards > > Julian Panke > > > > -------- Ursprüngliche Nachricht -------- > Am 24.07.25 00:18 schrieb J Doe <[email protected]>: > >> Hi, >> >> I have a small mail server that is using: BIND 9.20.11 and performs >> recursion and DNSSEC validation. >> >> From yesterday (July 22nd), to today (July 23rd), I noticed the >> following in the server logs >> >> 22-Jul-2025 23:59:50.347 lame-servers: info: no valid RRSIG resolving >> 'glb.nist.gov/DNSKEY/IN': 132.163.4.64#53 >> 22-Jul-2025 23:59:50.347 lame-servers: info: broken trust chain >> resolving 'ntp1.glb.nist.gov/A/IN': 129.6.13.8#53 >> 22-Jul-2025 23:59:50.347 query-errors: info: client @0xe3af1ee9020 >> 127.0.0.1#13211 (time.nist.gov): query failed (broken trust chain) for >> time.nist.gov/IN/A at query.c:7849 >> >> The host in question (time.nist.gov), is used by this server for NTP. >> The problem appears to have resolved itself today (July 23rd), at around >> 10:00 AM EDT and happily NTP is able to complete with this particular host. >> >> Did anyone else notice something similar ? >> >> Thanks, >> >> - J >> >> -- >> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list >> >> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. >> >> >> bind-users mailing list >> [email protected] >> https://lists.isc.org/mailman/listinfo/bind-users >> -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list [email protected] https://lists.isc.org/mailman/listinfo/bind-users