API tools faq
paste
Advertisement
sandroden

Failing Dig

sandroden
Oct 21st, 2021
78
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 84.20 KB | None | 0 0
raw download clone embed print report
  1.  
  2. recursor_1 | Oct 21 15:12:40 2 [1/1] question for 'dns1b.thux.lan|A' from 10.1.201.111:50681
  3. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'dns1b.thux.lan' among 1
  4. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  5. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  6. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  7. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=(empty): doResolve
  8. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for A
  9. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Recursion not requested for 'dns1b.thux.lan|A', peeking at auth/forward zones
  10. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=(empty): Step0 Not cached
  11. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=(empty): Step0 qname is in a forwarded domain thux.lan
  12. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'dns1b.thux.lan'
  13. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'dns1b.thux.lan'
  14. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=dns1b.thux.lan: Step2 New child
  15. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=dns1b.thux.lan: Step3 Going to do final resolve
  16. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for A
  17. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: No cache hit for 'dns1b.thux.lan|A', trying to find an appropriate NS record
  18. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'dns1b.thux.lan'
  19. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'dns1b.thux.lan'
  20. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'thux.lan'
  21. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'thux.lan'
  22. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'lan'
  23. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'lan'
  24. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for '.'
  25. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  26. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  27. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  28. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  29. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  30. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  31. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  32. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  33. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  34. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  35. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  36. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  37. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  38. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  39. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  40. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  41. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  42. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  43. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  44. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  45. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  46. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  47. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  48. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  49. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  50. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  51. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: We have NS in cache for '.' (flawedNSSet=0)
  52. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan authOrForwDomain: thux.lan nsFromCacheDomain: . isPartof: 1
  53. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: using forwarder as NS
  54. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Cache consultations done, have 1 NS to contact
  55. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Domain has hardcoded nameserver
  56. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan.: Nameservers: -212.31.253.25:53(0.00ms)
  57. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Resolved 'thux.lan' NS (empty) to: 212.31.253.25
  58. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Trying IP 212.31.253.25:53, asking 'dns1b.thux.lan|A'
  59. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  60. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Got 2 answers from (empty) (212.31.253.25), rcode=0 (No Error), aa=1, in 7ms
  61. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: accept answer 'dns1b.thux.lan|A|10.2.201.135' from 'thux.lan' nameservers? ttl=10800, place=1 YES! - This answer was received from a server we forward to.
  62. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: OPT answer '.' from 'thux.lan' nameservers
  63. recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for dns1b.thux.lan, we likely missed a cut between . and dns1b.thux.lan, looking for it
  64. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
  65. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  66. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  67. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  68. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): doResolve
  69. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  70. recursor_1 | Oct 21 15:12:40 [1] lan: Recursion not requested for 'lan|DS', peeking at auth/forward zones
  71. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step0 Not cached
  72. recursor_1 | Oct 21 15:12:40 [1] .: Checking if we have NS in cache for '.'
  73. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  74. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  75. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  76. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  77. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  78. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  79. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  80. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  81. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  82. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  83. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  84. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  85. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  86. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  87. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  88. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  89. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  90. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  91. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  92. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  93. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  94. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  95. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  96. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  97. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  98. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  99. recursor_1 | Oct 21 15:12:40 [1] .: We have NS in cache for '.' (flawedNSSet=0)
  100. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step1 Ancestor from cache is .
  101. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=lan: Step2 New child
  102. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=lan: Step3 Going to do final resolve
  103. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  104. recursor_1 | Oct 21 15:12:40 [1] lan: No cache hit for 'lan|DS', trying to find an appropriate NS record
  105. recursor_1 | Oct 21 15:12:40 [1] .: Checking if we have NS in cache for '.'
  106. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  107. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  108. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  109. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  110. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  111. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  112. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  113. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  114. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  115. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  116. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  117. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  118. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  119. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  120. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  121. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  122. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  123. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  124. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  125. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  126. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  127. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  128. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  129. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  130. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  131. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  132. recursor_1 | Oct 21 15:12:40 [1] .: We have NS in cache for '.' (flawedNSSet=0)
  133. recursor_1 | Oct 21 15:12:40 [1] lan: Cache consultations done, have 13 NS to contact
  134. recursor_1 | Oct 21 15:12:40 [1] lan.: Nameservers: i.root-servers.net(0.00ms), d.root-servers.net(0.00ms), a.root-servers.net(0.00ms),
  135. recursor_1 | Oct 21 15:12:40 [1] lan.: f.root-servers.net(0.00ms), m.root-servers.net(0.00ms), e.root-servers.net(0.00ms),
  136. recursor_1 | Oct 21 15:12:40 [1] lan.: l.root-servers.net(0.00ms), j.root-servers.net(0.00ms), g.root-servers.net(0.00ms),
  137. recursor_1 | Oct 21 15:12:40 [1] lan.: k.root-servers.net(0.00ms), h.root-servers.net(0.00ms), c.root-servers.net(0.00ms),
  138. recursor_1 | Oct 21 15:12:40 [1] lan.: b.root-servers.net(0.00ms)
  139. recursor_1 | Oct 21 15:12:40 [1] lan: Trying to resolve NS 'i.root-servers.net' (1/13)
  140. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'i.root-servers.net' among 1
  141. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  142. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  143. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  144. recursor_1 | Oct 21 15:12:40 [1] QM i.root-servers.net.|A child=(empty): doResolve
  145. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  146. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: Recursion not requested for 'i.root-servers.net|A', peeking at auth/forward zones
  147. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: Found cache hit for A: 192.36.148.17[ttl=86379]
  148. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: updating validation state with cache content for i.root-servers.net to Indeterminate
  149. recursor_1 | Oct 21 15:12:40 [1] QM i.root-servers.net.|A child=(empty): Step0 Found in cache
  150. recursor_1 | Oct 21 15:12:40 [1] Nameserver i.root-servers.net IPs: 192.36.148.17(0.00ms)
  151. recursor_1 | Oct 21 15:12:40 [1] lan: Resolved '.' NS i.root-servers.net to: 192.36.148.17
  152. recursor_1 | Oct 21 15:12:40 [1] lan: Trying IP 192.36.148.17:53, asking 'lan|DS'
  153. recursor_1 | Oct 21 15:12:40 [1] lan: Got 7 answers from i.root-servers.net (192.36.148.17), rcode=3 (Non-Existent domain), aa=1, in 62ms
  154. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  155. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  156. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  157. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  158. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  159. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  160. recursor_1 | Oct 21 15:12:40 [1] lan: OPT answer '.' from '.' nameservers
  161. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  162. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  163. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  164. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  165. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  166. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  167. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  168. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  169. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  170. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  171. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  172. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  173. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  174. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  175. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  176. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  177. recursor_1 | Oct 21 15:12:40 [1] Secure!
  178. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  179. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  180. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  181. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  182. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  183. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  184. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  185. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  186. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  187. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  188. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  189. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  190. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  191. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  192. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  193. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  194. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  195. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  196. recursor_1 | Oct 21 15:12:40 [1] Secure!
  197. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  198. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  199. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  200. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  201. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  202. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  203. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  204. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  205. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  206. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  207. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  208. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  209. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  210. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  211. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  212. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  213. recursor_1 | Oct 21 15:12:40 [1] Secure!
  214. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  215. recursor_1 | Oct 21 15:12:40 [1] lan: determining status after receiving this packet
  216. recursor_1 | Oct 21 15:12:40 [1] lan: got negative caching indication for name 'lan' (accept=1), newtarget='(empty)'
  217. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  218. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  219. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  220. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=lan, 0, next: aaa
  221. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  222. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  223. recursor_1 | Oct 21 15:12:40 lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  224. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for lan/TYPE0
  225. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  226. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  227. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  228. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  229. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  230. recursor_1 | Oct 21 15:12:40 [1] lan: status=NXDOMAIN, we are done (have negative SOA)
  231. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  232. recursor_1 | Oct 21 15:12:40 [1] lan: failed (res=3)
  233. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=lan: Step3 Final resolve: Non-Existent domain/6
  234. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at thux.lan
  235. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  236. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  237. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  238. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  239. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): doResolve
  240. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  241. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Recursion not requested for 'thux.lan|DS', peeking at auth/forward zones
  242. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 Not cached
  243. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  244. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step2 New child
  245. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Going to do final resolve
  246. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  247. recursor_1 | Oct 21 15:12:40 [1] thux.lan: No cache hit for 'thux.lan|DS', trying to find an appropriate NS record
  248. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for 'lan'
  249. recursor_1 | Oct 21 15:12:40 [1] lan: no valid/useful NS in cache for 'lan'
  250. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for '.'
  251. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  252. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  253. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  254. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  255. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  256. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  257. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  258. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  259. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  260. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  261. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  262. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  263. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  264. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  265. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  266. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  267. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  268. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  269. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  270. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  271. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  272. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  273. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  274. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  275. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  276. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  277. recursor_1 | Oct 21 15:12:40 [1] lan: We have NS in cache for '.' (flawedNSSet=0)
  278. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Cache consultations done, have 13 NS to contact
  279. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: Nameservers: a.root-servers.net(0.00ms), k.root-servers.net(0.00ms), d.root-servers.net(0.00ms),
  280. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: l.root-servers.net(0.00ms), c.root-servers.net(0.00ms), e.root-servers.net(0.00ms),
  281. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: h.root-servers.net(0.00ms), f.root-servers.net(0.00ms), m.root-servers.net(0.00ms),
  282. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: b.root-servers.net(0.00ms), g.root-servers.net(0.00ms), j.root-servers.net(0.00ms),
  283. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: i.root-servers.net(62.02ms)
  284. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying to resolve NS 'a.root-servers.net' (1/13)
  285. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'a.root-servers.net' among 1
  286. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  287. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  288. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  289. recursor_1 | Oct 21 15:12:40 [1] QM a.root-servers.net.|A child=(empty): doResolve
  290. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  291. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: Recursion not requested for 'a.root-servers.net|A', peeking at auth/forward zones
  292. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: Found cache hit for A: 198.41.0.4[ttl=86379]
  293. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: updating validation state with cache content for a.root-servers.net to Indeterminate
  294. recursor_1 | Oct 21 15:12:40 [1] QM a.root-servers.net.|A child=(empty): Step0 Found in cache
  295. recursor_1 | Oct 21 15:12:40 [1] Nameserver a.root-servers.net IPs: 198.41.0.4(0.00ms)
  296. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Resolved '.' NS a.root-servers.net to: 198.41.0.4
  297. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying IP 198.41.0.4:53, asking 'thux.lan|DS'
  298. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  299. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Got 7 answers from a.root-servers.net (198.41.0.4), rcode=3 (Non-Existent domain), aa=1, in 37ms
  300. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  301. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  302. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  303. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  304. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  305. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  306. recursor_1 | Oct 21 15:12:40 [1] thux.lan: OPT answer '.' from '.' nameservers
  307. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  308. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  309. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  310. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  311. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  312. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  313. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  314. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  315. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  316. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  317. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  318. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  319. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  320. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  321. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  322. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  323. recursor_1 | Oct 21 15:12:40 [1] Secure!
  324. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  325. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  326. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  327. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  328. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  329. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  330. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  331. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  332. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  333. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  334. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  335. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  336. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  337. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  338. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  339. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  340. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  341. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  342. recursor_1 | Oct 21 15:12:40 [1] Secure!
  343. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  344. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  345. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  346. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  347. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  348. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  349. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  350. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  351. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  352. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  353. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  354. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  355. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  356. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  357. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  358. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  359. recursor_1 | Oct 21 15:12:40 [1] Secure!
  360. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  361. recursor_1 | Oct 21 15:12:40 [1] thux.lan: determining status after receiving this packet
  362. recursor_1 | Oct 21 15:12:40 [1] thux.lan: got negative caching indication for name 'thux.lan' (accept=1), newtarget='(empty)'
  363. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  364. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  365. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  366. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=thux.lan, 0, next: aaa
  367. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  368. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  369. recursor_1 | Oct 21 15:12:40 thux.lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  370. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for thux.lan/TYPE0
  371. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  372. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  373. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  374. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  375. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  376. recursor_1 | Oct 21 15:12:40 [1] thux.lan: status=NXDOMAIN, we are done (have negative SOA)
  377. recursor_1 | Oct 21 15:12:40 [1] thux.lan: failed (res=3)
  378. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Final resolve: Non-Existent domain/6
  379. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at dns1b.thux.lan
  380. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'dns1b.thux.lan' among 1
  381. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'dns1b.thux.lan' among 1
  382. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  383. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  384. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  385. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=(empty): doResolve
  386. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for DS
  387. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Recursion not requested for 'dns1b.thux.lan|DS', peeking at auth/forward zones
  388. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=(empty): Step0 Not cached
  389. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  390. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=dns1b.thux.lan: Step2 New child
  391. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=dns1b.thux.lan: Step3 Going to do final resolve
  392. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for DS
  393. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: No cache hit for 'dns1b.thux.lan|DS', trying to find an appropriate NS record
  394. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Checking if we have NS in cache for 'thux.lan'
  395. recursor_1 | Oct 21 15:12:40 [1] thux.lan: no valid/useful NS in cache for 'thux.lan'
  396. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Checking if we have NS in cache for 'lan'
  397. recursor_1 | Oct 21 15:12:40 [1] thux.lan: no valid/useful NS in cache for 'lan'
  398. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Checking if we have NS in cache for '.'
  399. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  400. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  401. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  402. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  403. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  404. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  405. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  406. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  407. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  408. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  409. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  410. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  411. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  412. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  413. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  414. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  415. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  416. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  417. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  418. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  419. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  420. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  421. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  422. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  423. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  424. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  425. recursor_1 | Oct 21 15:12:40 [1] thux.lan: We have NS in cache for '.' (flawedNSSet=0)
  426. recursor_1 | Oct 21 15:12:40 [1] thux.lan authOrForwDomain: thux.lan nsFromCacheDomain: . isPartof: 1
  427. recursor_1 | Oct 21 15:12:40 [1] thux.lan: using forwarder as NS
  428. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Cache consultations done, have 1 NS to contact
  429. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Domain has hardcoded nameserver
  430. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan.: Nameservers: -212.31.253.25:53(7.45ms)
  431. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Resolved 'thux.lan' NS (empty) to: 212.31.253.25
  432. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Trying IP 212.31.253.25:53, asking 'dns1b.thux.lan|DS'
  433. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  434. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Got 2 answers from (empty) (212.31.253.25), rcode=0 (No Error), aa=1, in 2ms
  435. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: accept answer 'thux.lan|SOA|a.misconfigured.dns.server.invalid. hostmaster.thux.lan. 2021092801 10800 3600 604800 3600' from 'thux.lan' nameservers? ttl=3600, place=2 YES! - This answer was received from a server we forward to.
  436. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: OPT answer '.' from 'thux.lan' nameservers
  437. recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for thux.lan, we likely missed a cut between . and thux.lan, looking for it
  438. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
  439. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  440. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  441. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  442. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): doResolve
  443. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  444. recursor_1 | Oct 21 15:12:40 [1] lan: Recursion not requested for 'lan|DS', peeking at auth/forward zones
  445. recursor_1 | Oct 21 15:12:40 [1] lan: Entire name 'lan', is negatively cached via '.' & 'lan' for another 3600 seconds
  446. recursor_1 | Oct 21 15:12:40 [1] lan: updating validation state with negative cache content for lan to Secure
  447. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step0 Found in cache
  448. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at thux.lan
  449. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  450. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  451. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  452. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  453. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): doResolve
  454. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  455. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Recursion not requested for 'thux.lan|DS', peeking at auth/forward zones
  456. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 Not cached
  457. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  458. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step2 New child
  459. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Going to do final resolve
  460. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  461. recursor_1 | Oct 21 15:12:40 [1] thux.lan: No cache hit for 'thux.lan|DS', trying to find an appropriate NS record
  462. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for 'lan'
  463. recursor_1 | Oct 21 15:12:40 [1] lan: no valid/useful NS in cache for 'lan'
  464. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for '.'
  465. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  466. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  467. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  468. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  469. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  470. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  471. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  472. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  473. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  474. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  475. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  476. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  477. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  478. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  479. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  480. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  481. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  482. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  483. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  484. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  485. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  486. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  487. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  488. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  489. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  490. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  491. recursor_1 | Oct 21 15:12:40 [1] lan: We have NS in cache for '.' (flawedNSSet=0)
  492. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Cache consultations done, have 13 NS to contact
  493. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: Nameservers: l.root-servers.net(0.00ms), e.root-servers.net(0.00ms), h.root-servers.net(0.00ms),
  494. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: c.root-servers.net(0.00ms), f.root-servers.net(0.00ms), d.root-servers.net(0.00ms),
  495. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: k.root-servers.net(0.00ms), j.root-servers.net(0.00ms), m.root-servers.net(0.00ms),
  496. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: b.root-servers.net(0.00ms), g.root-servers.net(0.00ms), a.root-servers.net(37.71ms),
  497. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: i.root-servers.net(61.97ms)
  498. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying to resolve NS 'l.root-servers.net' (1/13)
  499. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'l.root-servers.net' among 1
  500. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  501. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  502. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  503. recursor_1 | Oct 21 15:12:40 [1] QM l.root-servers.net.|A child=(empty): doResolve
  504. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  505. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: Recursion not requested for 'l.root-servers.net|A', peeking at auth/forward zones
  506. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: Found cache hit for A: 199.7.83.42[ttl=86379]
  507. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: updating validation state with cache content for l.root-servers.net to Indeterminate
  508. recursor_1 | Oct 21 15:12:40 [1] QM l.root-servers.net.|A child=(empty): Step0 Found in cache
  509. recursor_1 | Oct 21 15:12:40 [1] Nameserver l.root-servers.net IPs: 199.7.83.42(0.00ms)
  510. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Resolved '.' NS l.root-servers.net to: 199.7.83.42
  511. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying IP 199.7.83.42:53, asking 'thux.lan|DS'
  512. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  513. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Got 7 answers from l.root-servers.net (199.7.83.42), rcode=3 (Non-Existent domain), aa=1, in 16ms
  514. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  515. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  516. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  517. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  518. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  519. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  520. recursor_1 | Oct 21 15:12:40 [1] thux.lan: OPT answer '.' from '.' nameservers
  521. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  522. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  523. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  524. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  525. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  526. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  527. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  528. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  529. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  530. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  531. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  532. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  533. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  534. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  535. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  536. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  537. recursor_1 | Oct 21 15:12:40 [1] Secure!
  538. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  539. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  540. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  541. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  542. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  543. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  544. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  545. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  546. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  547. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  548. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  549. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  550. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  551. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  552. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  553. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  554. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  555. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  556. recursor_1 | Oct 21 15:12:40 [1] Secure!
  557. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  558. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  559. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  560. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  561. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  562. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  563. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  564. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  565. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  566. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  567. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  568. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  569. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  570. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  571. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  572. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  573. recursor_1 | Oct 21 15:12:40 [1] Secure!
  574. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  575. recursor_1 | Oct 21 15:12:40 [1] thux.lan: determining status after receiving this packet
  576. recursor_1 | Oct 21 15:12:40 [1] thux.lan: got negative caching indication for name 'thux.lan' (accept=1), newtarget='(empty)'
  577. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  578. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  579. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  580. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=thux.lan, 0, next: aaa
  581. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  582. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  583. recursor_1 | Oct 21 15:12:40 thux.lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  584. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for thux.lan/TYPE0
  585. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  586. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  587. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  588. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  589. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  590. recursor_1 | Oct 21 15:12:40 [1] thux.lan: status=NXDOMAIN, we are done (have negative SOA)
  591. recursor_1 | Oct 21 15:12:40 [1] thux.lan: failed (res=3)
  592. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Final resolve: Non-Existent domain/6
  593. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record thux.lan|SOA
  594. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for thux.lan
  595. recursor_1 | Oct 21 15:12:40 [1] Bogus!
  596. recursor_1 | Oct 21 15:12:40 [1] Validation result is Bogus - No RRSIG, current state is Indeterminate
  597. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Bogus - No RRSIG, validation state is now Bogus - No RRSIG
  598. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: determining status after receiving this packet
  599. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: got negative caching indication for 'dns1b.thux.lan|DS'
  600. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: status=noerror, other types may exist, but we are done (have negative SOA) (have aa bit)
  601. recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for dns1b.thux.lan, we likely missed a cut between . and thux.lan, looking for it
  602. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
  603. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  604. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  605. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  606. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): doResolve
  607. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  608. recursor_1 | Oct 21 15:12:40 [1] lan: Recursion not requested for 'lan|DS', peeking at auth/forward zones
  609. recursor_1 | Oct 21 15:12:40 [1] lan: Entire name 'lan', is negatively cached via '.' & 'lan' for another 3600 seconds
  610. recursor_1 | Oct 21 15:12:40 [1] lan: updating validation state with negative cache content for lan to Secure
  611. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step0 Found in cache
  612. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at thux.lan
  613. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  614. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  615. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  616. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  617. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): doResolve
  618. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  619. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Recursion not requested for 'thux.lan|DS', peeking at auth/forward zones
  620. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 Not cached
  621. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  622. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step2 New child
  623. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Going to do final resolve
  624. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  625. recursor_1 | Oct 21 15:12:40 [1] thux.lan: No cache hit for 'thux.lan|DS', trying to find an appropriate NS record
  626. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for 'lan'
  627. recursor_1 | Oct 21 15:12:40 [1] lan: no valid/useful NS in cache for 'lan'
  628. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for '.'
  629. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  630. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  631. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  632. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  633. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  634. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  635. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  636. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  637. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  638. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  639. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  640. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  641. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  642. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  643. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  644. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  645. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  646. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  647. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  648. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  649. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  650. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  651. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  652. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  653. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  654. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  655. recursor_1 | Oct 21 15:12:40 [1] lan: We have NS in cache for '.' (flawedNSSet=0)
  656. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Cache consultations done, have 13 NS to contact
  657. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: Nameservers: m.root-servers.net(0.00ms), e.root-servers.net(0.00ms), h.root-servers.net(0.00ms),
  658. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: g.root-servers.net(0.00ms), c.root-servers.net(0.00ms), d.root-servers.net(0.00ms),
  659. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: j.root-servers.net(0.00ms), f.root-servers.net(0.00ms), k.root-servers.net(0.00ms),
  660. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: b.root-servers.net(0.00ms), l.root-servers.net(16.65ms), a.root-servers.net(37.70ms),
  661. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: i.root-servers.net(61.96ms)
  662. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying to resolve NS 'm.root-servers.net' (1/13)
  663. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'm.root-servers.net' among 1
  664. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  665. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  666. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  667. recursor_1 | Oct 21 15:12:40 [1] QM m.root-servers.net.|A child=(empty): doResolve
  668. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  669. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: Recursion not requested for 'm.root-servers.net|A', peeking at auth/forward zones
  670. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: Found cache hit for A: 202.12.27.33[ttl=86379]
  671. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: updating validation state with cache content for m.root-servers.net to Indeterminate
  672. recursor_1 | Oct 21 15:12:40 [1] QM m.root-servers.net.|A child=(empty): Step0 Found in cache
  673. recursor_1 | Oct 21 15:12:40 [1] Nameserver m.root-servers.net IPs: 202.12.27.33(0.00ms)
  674. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Resolved '.' NS m.root-servers.net to: 202.12.27.33
  675. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying IP 202.12.27.33:53, asking 'thux.lan|DS'
  676. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  677. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Got 7 answers from m.root-servers.net (202.12.27.33), rcode=3 (Non-Existent domain), aa=1, in 37ms
  678. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  679. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  680. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  681. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  682. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  683. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  684. recursor_1 | Oct 21 15:12:40 [1] thux.lan: OPT answer '.' from '.' nameservers
  685. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  686. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  687. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  688. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  689. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  690. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  691. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  692. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  693. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  694. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  695. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  696. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  697. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  698. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  699. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  700. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  701. recursor_1 | Oct 21 15:12:40 [1] Secure!
  702. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  703. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  704. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  705. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  706. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  707. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  708. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  709. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  710. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  711. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  712. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  713. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  714. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  715. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  716. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  717. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  718. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  719. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  720. recursor_1 | Oct 21 15:12:40 [1] Secure!
  721. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  722. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  723. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  724. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  725. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  726. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  727. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  728. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  729. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  730. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  731. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  732. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  733. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  734. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  735. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  736. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  737. recursor_1 | Oct 21 15:12:40 [1] Secure!
  738. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  739. recursor_1 | Oct 21 15:12:40 [1] thux.lan: determining status after receiving this packet
  740. recursor_1 | Oct 21 15:12:40 [1] thux.lan: got negative caching indication for name 'thux.lan' (accept=1), newtarget='(empty)'
  741. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  742. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  743. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  744. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=thux.lan, 0, next: aaa
  745. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  746. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  747. recursor_1 | Oct 21 15:12:40 thux.lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  748. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for thux.lan/TYPE0
  749. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  750. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  751. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  752. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  753. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  754. recursor_1 | Oct 21 15:12:40 [1] thux.lan: status=NXDOMAIN, we are done (have negative SOA)
  755. recursor_1 | Oct 21 15:12:40 [1] thux.lan: failed (res=3)
  756. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Final resolve: Non-Existent domain/6
  757. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=dns1b.thux.lan: Step3 Final resolve: No Error/1
  758. recursor_1 | Oct 21 15:12:40 [1] : - Found cut at dns1b.thux.lan
  759. recursor_1 | Oct 21 15:12:40 [1] : New state for dns1b.thux.lan is Bogus - No RRSIG
  760. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Bogus - No RRSIG for record dns1b.thux.lan|A
  761. recursor_1 | Oct 21 15:12:40 [1] Skipping validation because the current state is Bogus - No RRSIG
  762. recursor_1 | Oct 21 15:12:40 [1] Validation result is Bogus - No RRSIG, current state is Indeterminate
  763. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Bogus - No RRSIG, validation state is now Bogus - No RRSIG
  764. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: determining status after receiving this packet
  765. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: answer is in: resolved to '10.2.201.135|A'
  766. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: status=got results, this level of recursion done
  767. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: validation status is Bogus - No RRSIG
  768. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=dns1b.thux.lan: Step3 Final resolve: No Error/1
  769. recursor_1 | Oct 21 15:12:40 Answer to dns1b.thux.lan|A for 10.1.201.111:50681 validates as Bogus - No RRSIG
  770. recursor_1 | Oct 21 15:12:40 Sending out SERVFAIL for dns1b.thux.lan|A because recursor or query demands it for Bogus results
  771. recursor_1 | Oct 21 15:12:40 2 [1/1] answer to question 'dns1b.thux.lan|A': 0 answers, 1 additional, took 6 packets, 164.251 netw ms, 170.306 tot ms, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0, dnssec=Bogus - No RRSIG
  772.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!