Advertisement
sandroden

Failing Dig

Oct 21st, 2021
40
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2. recursor_1 | Oct 21 15:12:40 2 [1/1] question for 'dns1b.thux.lan|A' from 10.1.201.111:50681
  3. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'dns1b.thux.lan' among 1
  4. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  5. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  6. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  7. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=(empty): doResolve
  8. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for A
  9. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Recursion not requested for 'dns1b.thux.lan|A', peeking at auth/forward zones
  10. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=(empty): Step0 Not cached
  11. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=(empty): Step0 qname is in a forwarded domain thux.lan
  12. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'dns1b.thux.lan'
  13. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'dns1b.thux.lan'
  14. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=dns1b.thux.lan: Step2 New child
  15. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=dns1b.thux.lan: Step3 Going to do final resolve
  16. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for A
  17. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: No cache hit for 'dns1b.thux.lan|A', trying to find an appropriate NS record
  18. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'dns1b.thux.lan'
  19. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'dns1b.thux.lan'
  20. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'thux.lan'
  21. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'thux.lan'
  22. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for 'lan'
  23. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: no valid/useful NS in cache for 'lan'
  24. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Checking if we have NS in cache for '.'
  25. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  26. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  27. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  28. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  29. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  30. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  31. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  32. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  33. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  34. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  35. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  36. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  37. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  38. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  39. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  40. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  41. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  42. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  43. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  44. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  45. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  46. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  47. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  48. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  49. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  50. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: within bailiwick: 1, in cache, ttl=86379
  51. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: We have NS in cache for '.' (flawedNSSet=0)
  52. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan authOrForwDomain: thux.lan nsFromCacheDomain: . isPartof: 1
  53. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: using forwarder as NS
  54. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Cache consultations done, have 1 NS to contact
  55. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Domain has hardcoded nameserver
  56. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan.: Nameservers: -212.31.253.25:53(0.00ms)
  57. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Resolved 'thux.lan' NS (empty) to: 212.31.253.25
  58. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Trying IP 212.31.253.25:53, asking 'dns1b.thux.lan|A'
  59. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  60. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Got 2 answers from (empty) (212.31.253.25), rcode=0 (No Error), aa=1, in 7ms
  61. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: accept answer 'dns1b.thux.lan|A|10.2.201.135' from 'thux.lan' nameservers? ttl=10800, place=1 YES! - This answer was received from a server we forward to.
  62. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: OPT answer '.' from 'thux.lan' nameservers
  63. recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for dns1b.thux.lan, we likely missed a cut between . and dns1b.thux.lan, looking for it
  64. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
  65. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  66. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  67. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  68. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): doResolve
  69. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  70. recursor_1 | Oct 21 15:12:40 [1] lan: Recursion not requested for 'lan|DS', peeking at auth/forward zones
  71. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step0 Not cached
  72. recursor_1 | Oct 21 15:12:40 [1] .: Checking if we have NS in cache for '.'
  73. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  74. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  75. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  76. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  77. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  78. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  79. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  80. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  81. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  82. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  83. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  84. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  85. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  86. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  87. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  88. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  89. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  90. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  91. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  92. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  93. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  94. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  95. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  96. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  97. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  98. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  99. recursor_1 | Oct 21 15:12:40 [1] .: We have NS in cache for '.' (flawedNSSet=0)
  100. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step1 Ancestor from cache is .
  101. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=lan: Step2 New child
  102. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=lan: Step3 Going to do final resolve
  103. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  104. recursor_1 | Oct 21 15:12:40 [1] lan: No cache hit for 'lan|DS', trying to find an appropriate NS record
  105. recursor_1 | Oct 21 15:12:40 [1] .: Checking if we have NS in cache for '.'
  106. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  107. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  108. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  109. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  110. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  111. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  112. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  113. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  114. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  115. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  116. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  117. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  118. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  119. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  120. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  121. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  122. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  123. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  124. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  125. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  126. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  127. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  128. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  129. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  130. recursor_1 | Oct 21 15:12:40 [1] .: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  131. recursor_1 | Oct 21 15:12:40 [1] .: within bailiwick: 1, in cache, ttl=86379
  132. recursor_1 | Oct 21 15:12:40 [1] .: We have NS in cache for '.' (flawedNSSet=0)
  133. recursor_1 | Oct 21 15:12:40 [1] lan: Cache consultations done, have 13 NS to contact
  134. recursor_1 | Oct 21 15:12:40 [1] lan.: Nameservers: i.root-servers.net(0.00ms), d.root-servers.net(0.00ms), a.root-servers.net(0.00ms),
  135. recursor_1 | Oct 21 15:12:40 [1] lan.: f.root-servers.net(0.00ms), m.root-servers.net(0.00ms), e.root-servers.net(0.00ms),
  136. recursor_1 | Oct 21 15:12:40 [1] lan.: l.root-servers.net(0.00ms), j.root-servers.net(0.00ms), g.root-servers.net(0.00ms),
  137. recursor_1 | Oct 21 15:12:40 [1] lan.: k.root-servers.net(0.00ms), h.root-servers.net(0.00ms), c.root-servers.net(0.00ms),
  138. recursor_1 | Oct 21 15:12:40 [1] lan.: b.root-servers.net(0.00ms)
  139. recursor_1 | Oct 21 15:12:40 [1] lan: Trying to resolve NS 'i.root-servers.net' (1/13)
  140. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'i.root-servers.net' among 1
  141. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  142. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  143. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  144. recursor_1 | Oct 21 15:12:40 [1] QM i.root-servers.net.|A child=(empty): doResolve
  145. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  146. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: Recursion not requested for 'i.root-servers.net|A', peeking at auth/forward zones
  147. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: Found cache hit for A: 192.36.148.17[ttl=86379]
  148. recursor_1 | Oct 21 15:12:40 [1] i.root-servers.net: updating validation state with cache content for i.root-servers.net to Indeterminate
  149. recursor_1 | Oct 21 15:12:40 [1] QM i.root-servers.net.|A child=(empty): Step0 Found in cache
  150. recursor_1 | Oct 21 15:12:40 [1] Nameserver i.root-servers.net IPs: 192.36.148.17(0.00ms)
  151. recursor_1 | Oct 21 15:12:40 [1] lan: Resolved '.' NS i.root-servers.net to: 192.36.148.17
  152. recursor_1 | Oct 21 15:12:40 [1] lan: Trying IP 192.36.148.17:53, asking 'lan|DS'
  153. recursor_1 | Oct 21 15:12:40 [1] lan: Got 7 answers from i.root-servers.net (192.36.148.17), rcode=3 (Non-Existent domain), aa=1, in 62ms
  154. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  155. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  156. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  157. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  158. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  159. recursor_1 | Oct 21 15:12:40 [1] lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  160. recursor_1 | Oct 21 15:12:40 [1] lan: OPT answer '.' from '.' nameservers
  161. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  162. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  163. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  164. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  165. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  166. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  167. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  168. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  169. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  170. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  171. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  172. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  173. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  174. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  175. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  176. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  177. recursor_1 | Oct 21 15:12:40 [1] Secure!
  178. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  179. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  180. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  181. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  182. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  183. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  184. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  185. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  186. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  187. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  188. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  189. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  190. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  191. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  192. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  193. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  194. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  195. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  196. recursor_1 | Oct 21 15:12:40 [1] Secure!
  197. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  198. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  199. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  200. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  201. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  202. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  203. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  204. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  205. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  206. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  207. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  208. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  209. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  210. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  211. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  212. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  213. recursor_1 | Oct 21 15:12:40 [1] Secure!
  214. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  215. recursor_1 | Oct 21 15:12:40 [1] lan: determining status after receiving this packet
  216. recursor_1 | Oct 21 15:12:40 [1] lan: got negative caching indication for name 'lan' (accept=1), newtarget='(empty)'
  217. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  218. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  219. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  220. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=lan, 0, next: aaa
  221. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  222. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  223. recursor_1 | Oct 21 15:12:40 lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  224. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for lan/TYPE0
  225. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  226. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  227. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  228. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  229. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  230. recursor_1 | Oct 21 15:12:40 [1] lan: status=NXDOMAIN, we are done (have negative SOA)
  231. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  232. recursor_1 | Oct 21 15:12:40 [1] lan: failed (res=3)
  233. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=lan: Step3 Final resolve: Non-Existent domain/6
  234. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at thux.lan
  235. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  236. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  237. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  238. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  239. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): doResolve
  240. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  241. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Recursion not requested for 'thux.lan|DS', peeking at auth/forward zones
  242. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 Not cached
  243. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  244. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step2 New child
  245. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Going to do final resolve
  246. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  247. recursor_1 | Oct 21 15:12:40 [1] thux.lan: No cache hit for 'thux.lan|DS', trying to find an appropriate NS record
  248. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for 'lan'
  249. recursor_1 | Oct 21 15:12:40 [1] lan: no valid/useful NS in cache for 'lan'
  250. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for '.'
  251. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  252. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  253. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  254. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  255. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  256. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  257. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  258. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  259. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  260. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  261. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  262. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  263. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  264. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  265. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  266. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  267. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  268. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  269. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  270. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  271. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  272. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  273. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  274. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  275. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  276. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  277. recursor_1 | Oct 21 15:12:40 [1] lan: We have NS in cache for '.' (flawedNSSet=0)
  278. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Cache consultations done, have 13 NS to contact
  279. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: Nameservers: a.root-servers.net(0.00ms), k.root-servers.net(0.00ms), d.root-servers.net(0.00ms),
  280. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: l.root-servers.net(0.00ms), c.root-servers.net(0.00ms), e.root-servers.net(0.00ms),
  281. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: h.root-servers.net(0.00ms), f.root-servers.net(0.00ms), m.root-servers.net(0.00ms),
  282. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: b.root-servers.net(0.00ms), g.root-servers.net(0.00ms), j.root-servers.net(0.00ms),
  283. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: i.root-servers.net(62.02ms)
  284. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying to resolve NS 'a.root-servers.net' (1/13)
  285. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'a.root-servers.net' among 1
  286. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  287. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  288. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  289. recursor_1 | Oct 21 15:12:40 [1] QM a.root-servers.net.|A child=(empty): doResolve
  290. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  291. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: Recursion not requested for 'a.root-servers.net|A', peeking at auth/forward zones
  292. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: Found cache hit for A: 198.41.0.4[ttl=86379]
  293. recursor_1 | Oct 21 15:12:40 [1] a.root-servers.net: updating validation state with cache content for a.root-servers.net to Indeterminate
  294. recursor_1 | Oct 21 15:12:40 [1] QM a.root-servers.net.|A child=(empty): Step0 Found in cache
  295. recursor_1 | Oct 21 15:12:40 [1] Nameserver a.root-servers.net IPs: 198.41.0.4(0.00ms)
  296. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Resolved '.' NS a.root-servers.net to: 198.41.0.4
  297. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying IP 198.41.0.4:53, asking 'thux.lan|DS'
  298. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  299. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Got 7 answers from a.root-servers.net (198.41.0.4), rcode=3 (Non-Existent domain), aa=1, in 37ms
  300. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  301. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  302. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  303. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  304. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  305. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  306. recursor_1 | Oct 21 15:12:40 [1] thux.lan: OPT answer '.' from '.' nameservers
  307. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  308. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  309. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  310. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  311. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  312. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  313. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  314. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  315. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  316. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  317. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  318. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  319. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  320. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  321. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  322. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  323. recursor_1 | Oct 21 15:12:40 [1] Secure!
  324. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  325. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  326. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  327. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  328. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  329. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  330. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  331. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  332. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  333. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  334. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  335. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  336. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  337. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  338. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  339. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  340. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  341. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  342. recursor_1 | Oct 21 15:12:40 [1] Secure!
  343. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  344. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  345. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  346. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  347. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  348. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  349. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  350. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  351. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  352. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  353. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  354. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  355. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  356. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  357. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  358. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  359. recursor_1 | Oct 21 15:12:40 [1] Secure!
  360. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  361. recursor_1 | Oct 21 15:12:40 [1] thux.lan: determining status after receiving this packet
  362. recursor_1 | Oct 21 15:12:40 [1] thux.lan: got negative caching indication for name 'thux.lan' (accept=1), newtarget='(empty)'
  363. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  364. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  365. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  366. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=thux.lan, 0, next: aaa
  367. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  368. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  369. recursor_1 | Oct 21 15:12:40 thux.lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  370. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for thux.lan/TYPE0
  371. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  372. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  373. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  374. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  375. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  376. recursor_1 | Oct 21 15:12:40 [1] thux.lan: status=NXDOMAIN, we are done (have negative SOA)
  377. recursor_1 | Oct 21 15:12:40 [1] thux.lan: failed (res=3)
  378. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Final resolve: Non-Existent domain/6
  379. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at dns1b.thux.lan
  380. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'dns1b.thux.lan' among 1
  381. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'dns1b.thux.lan' among 1
  382. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  383. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  384. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  385. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=(empty): doResolve
  386. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for DS
  387. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Recursion not requested for 'dns1b.thux.lan|DS', peeking at auth/forward zones
  388. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=(empty): Step0 Not cached
  389. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  390. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=dns1b.thux.lan: Step2 New child
  391. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=dns1b.thux.lan: Step3 Going to do final resolve
  392. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Wants DNSSEC processing, auth data in query for DS
  393. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: No cache hit for 'dns1b.thux.lan|DS', trying to find an appropriate NS record
  394. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Checking if we have NS in cache for 'thux.lan'
  395. recursor_1 | Oct 21 15:12:40 [1] thux.lan: no valid/useful NS in cache for 'thux.lan'
  396. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Checking if we have NS in cache for 'lan'
  397. recursor_1 | Oct 21 15:12:40 [1] thux.lan: no valid/useful NS in cache for 'lan'
  398. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Checking if we have NS in cache for '.'
  399. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  400. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  401. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  402. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  403. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  404. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  405. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  406. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  407. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  408. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  409. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  410. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  411. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  412. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  413. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  414. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  415. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  416. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  417. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  418. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  419. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  420. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  421. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  422. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  423. recursor_1 | Oct 21 15:12:40 [1] thux.lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  424. recursor_1 | Oct 21 15:12:40 [1] thux.lan: within bailiwick: 1, in cache, ttl=86379
  425. recursor_1 | Oct 21 15:12:40 [1] thux.lan: We have NS in cache for '.' (flawedNSSet=0)
  426. recursor_1 | Oct 21 15:12:40 [1] thux.lan authOrForwDomain: thux.lan nsFromCacheDomain: . isPartof: 1
  427. recursor_1 | Oct 21 15:12:40 [1] thux.lan: using forwarder as NS
  428. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Cache consultations done, have 1 NS to contact
  429. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Domain has hardcoded nameserver
  430. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan.: Nameservers: -212.31.253.25:53(7.45ms)
  431. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Resolved 'thux.lan' NS (empty) to: 212.31.253.25
  432. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Trying IP 212.31.253.25:53, asking 'dns1b.thux.lan|DS'
  433. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  434. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: Got 2 answers from (empty) (212.31.253.25), rcode=0 (No Error), aa=1, in 2ms
  435. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: accept answer 'thux.lan|SOA|a.misconfigured.dns.server.invalid. hostmaster.thux.lan. 2021092801 10800 3600 604800 3600' from 'thux.lan' nameservers? ttl=3600, place=2 YES! - This answer was received from a server we forward to.
  436. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: OPT answer '.' from 'thux.lan' nameservers
  437. recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for thux.lan, we likely missed a cut between . and thux.lan, looking for it
  438. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
  439. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  440. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  441. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  442. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): doResolve
  443. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  444. recursor_1 | Oct 21 15:12:40 [1] lan: Recursion not requested for 'lan|DS', peeking at auth/forward zones
  445. recursor_1 | Oct 21 15:12:40 [1] lan: Entire name 'lan', is negatively cached via '.' & 'lan' for another 3600 seconds
  446. recursor_1 | Oct 21 15:12:40 [1] lan: updating validation state with negative cache content for lan to Secure
  447. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step0 Found in cache
  448. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at thux.lan
  449. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  450. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  451. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  452. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  453. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): doResolve
  454. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  455. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Recursion not requested for 'thux.lan|DS', peeking at auth/forward zones
  456. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 Not cached
  457. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  458. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step2 New child
  459. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Going to do final resolve
  460. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  461. recursor_1 | Oct 21 15:12:40 [1] thux.lan: No cache hit for 'thux.lan|DS', trying to find an appropriate NS record
  462. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for 'lan'
  463. recursor_1 | Oct 21 15:12:40 [1] lan: no valid/useful NS in cache for 'lan'
  464. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for '.'
  465. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  466. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  467. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  468. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  469. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  470. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  471. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  472. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  473. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  474. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  475. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  476. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  477. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  478. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  479. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  480. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  481. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  482. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  483. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  484. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  485. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  486. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  487. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  488. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  489. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  490. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  491. recursor_1 | Oct 21 15:12:40 [1] lan: We have NS in cache for '.' (flawedNSSet=0)
  492. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Cache consultations done, have 13 NS to contact
  493. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: Nameservers: l.root-servers.net(0.00ms), e.root-servers.net(0.00ms), h.root-servers.net(0.00ms),
  494. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: c.root-servers.net(0.00ms), f.root-servers.net(0.00ms), d.root-servers.net(0.00ms),
  495. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: k.root-servers.net(0.00ms), j.root-servers.net(0.00ms), m.root-servers.net(0.00ms),
  496. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: b.root-servers.net(0.00ms), g.root-servers.net(0.00ms), a.root-servers.net(37.71ms),
  497. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: i.root-servers.net(61.97ms)
  498. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying to resolve NS 'l.root-servers.net' (1/13)
  499. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'l.root-servers.net' among 1
  500. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  501. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  502. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  503. recursor_1 | Oct 21 15:12:40 [1] QM l.root-servers.net.|A child=(empty): doResolve
  504. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  505. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: Recursion not requested for 'l.root-servers.net|A', peeking at auth/forward zones
  506. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: Found cache hit for A: 199.7.83.42[ttl=86379]
  507. recursor_1 | Oct 21 15:12:40 [1] l.root-servers.net: updating validation state with cache content for l.root-servers.net to Indeterminate
  508. recursor_1 | Oct 21 15:12:40 [1] QM l.root-servers.net.|A child=(empty): Step0 Found in cache
  509. recursor_1 | Oct 21 15:12:40 [1] Nameserver l.root-servers.net IPs: 199.7.83.42(0.00ms)
  510. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Resolved '.' NS l.root-servers.net to: 199.7.83.42
  511. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying IP 199.7.83.42:53, asking 'thux.lan|DS'
  512. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  513. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Got 7 answers from l.root-servers.net (199.7.83.42), rcode=3 (Non-Existent domain), aa=1, in 16ms
  514. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  515. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  516. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  517. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  518. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  519. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  520. recursor_1 | Oct 21 15:12:40 [1] thux.lan: OPT answer '.' from '.' nameservers
  521. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  522. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  523. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  524. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  525. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  526. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  527. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  528. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  529. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  530. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  531. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  532. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  533. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  534. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  535. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  536. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  537. recursor_1 | Oct 21 15:12:40 [1] Secure!
  538. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  539. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  540. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  541. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  542. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  543. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  544. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  545. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  546. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  547. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  548. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  549. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  550. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  551. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  552. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  553. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  554. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  555. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  556. recursor_1 | Oct 21 15:12:40 [1] Secure!
  557. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  558. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  559. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  560. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  561. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  562. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  563. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  564. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  565. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  566. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  567. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  568. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  569. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  570. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  571. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  572. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  573. recursor_1 | Oct 21 15:12:40 [1] Secure!
  574. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  575. recursor_1 | Oct 21 15:12:40 [1] thux.lan: determining status after receiving this packet
  576. recursor_1 | Oct 21 15:12:40 [1] thux.lan: got negative caching indication for name 'thux.lan' (accept=1), newtarget='(empty)'
  577. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  578. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  579. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  580. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=thux.lan, 0, next: aaa
  581. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  582. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  583. recursor_1 | Oct 21 15:12:40 thux.lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  584. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for thux.lan/TYPE0
  585. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  586. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  587. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  588. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  589. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  590. recursor_1 | Oct 21 15:12:40 [1] thux.lan: status=NXDOMAIN, we are done (have negative SOA)
  591. recursor_1 | Oct 21 15:12:40 [1] thux.lan: failed (res=3)
  592. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Final resolve: Non-Existent domain/6
  593. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record thux.lan|SOA
  594. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for thux.lan
  595. recursor_1 | Oct 21 15:12:40 [1] Bogus!
  596. recursor_1 | Oct 21 15:12:40 [1] Validation result is Bogus - No RRSIG, current state is Indeterminate
  597. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Bogus - No RRSIG, validation state is now Bogus - No RRSIG
  598. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: determining status after receiving this packet
  599. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: got negative caching indication for 'dns1b.thux.lan|DS'
  600. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: status=noerror, other types may exist, but we are done (have negative SOA) (have aa bit)
  601. recursor_1 | Oct 21 15:12:40 [1] : no or invalid signature/proof for dns1b.thux.lan, we likely missed a cut between . and thux.lan, looking for it
  602. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at lan
  603. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  604. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  605. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  606. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): doResolve
  607. recursor_1 | Oct 21 15:12:40 [1] lan: Wants DNSSEC processing, auth data in query for DS
  608. recursor_1 | Oct 21 15:12:40 [1] lan: Recursion not requested for 'lan|DS', peeking at auth/forward zones
  609. recursor_1 | Oct 21 15:12:40 [1] lan: Entire name 'lan', is negatively cached via '.' & 'lan' for another 3600 seconds
  610. recursor_1 | Oct 21 15:12:40 [1] lan: updating validation state with negative cache content for lan to Secure
  611. recursor_1 | Oct 21 15:12:40 [1] QM lan.|DS child=(empty): Step0 Found in cache
  612. recursor_1 | Oct 21 15:12:40 [1] : - Looking for a DS at thux.lan
  613. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  614. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'thux.lan' among 1
  615. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'lan' among 1
  616. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  617. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): doResolve
  618. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  619. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Recursion not requested for 'thux.lan|DS', peeking at auth/forward zones
  620. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 Not cached
  621. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=(empty): Step0 qname is in a forwarded domain thux.lan
  622. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step2 New child
  623. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Going to do final resolve
  624. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Wants DNSSEC processing, auth data in query for DS
  625. recursor_1 | Oct 21 15:12:40 [1] thux.lan: No cache hit for 'thux.lan|DS', trying to find an appropriate NS record
  626. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for 'lan'
  627. recursor_1 | Oct 21 15:12:40 [1] lan: no valid/useful NS in cache for 'lan'
  628. recursor_1 | Oct 21 15:12:40 [1] lan: Checking if we have NS in cache for '.'
  629. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'l.root-servers.net'
  630. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  631. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'k.root-servers.net'
  632. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  633. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'f.root-servers.net'
  634. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  635. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'i.root-servers.net'
  636. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  637. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'e.root-servers.net'
  638. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  639. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'b.root-servers.net'
  640. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  641. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'j.root-servers.net'
  642. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  643. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'c.root-servers.net'
  644. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  645. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'd.root-servers.net'
  646. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  647. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'h.root-servers.net'
  648. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  649. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'g.root-servers.net'
  650. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  651. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'm.root-servers.net'
  652. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  653. recursor_1 | Oct 21 15:12:40 [1] lan: NS (with ip, or non-glue) in cache for '.' -> 'a.root-servers.net'
  654. recursor_1 | Oct 21 15:12:40 [1] lan: within bailiwick: 1, in cache, ttl=86379
  655. recursor_1 | Oct 21 15:12:40 [1] lan: We have NS in cache for '.' (flawedNSSet=0)
  656. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Cache consultations done, have 13 NS to contact
  657. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: Nameservers: m.root-servers.net(0.00ms), e.root-servers.net(0.00ms), h.root-servers.net(0.00ms),
  658. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: g.root-servers.net(0.00ms), c.root-servers.net(0.00ms), d.root-servers.net(0.00ms),
  659. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: j.root-servers.net(0.00ms), f.root-servers.net(0.00ms), k.root-servers.net(0.00ms),
  660. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: b.root-servers.net(0.00ms), l.root-servers.net(16.65ms), a.root-servers.net(37.70ms),
  661. recursor_1 | Oct 21 15:12:40 [1] thux.lan.: i.root-servers.net(61.96ms)
  662. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying to resolve NS 'm.root-servers.net' (1/13)
  663. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'm.root-servers.net' among 1
  664. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'root-servers.net' among 1
  665. recursor_1 | Oct 21 15:12:40 [1] : no TA found for 'net' among 1
  666. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  667. recursor_1 | Oct 21 15:12:40 [1] QM m.root-servers.net.|A child=(empty): doResolve
  668. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: Wants DNSSEC processing, NO auth data in query for A
  669. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: Recursion not requested for 'm.root-servers.net|A', peeking at auth/forward zones
  670. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: Found cache hit for A: 202.12.27.33[ttl=86379]
  671. recursor_1 | Oct 21 15:12:40 [1] m.root-servers.net: updating validation state with cache content for m.root-servers.net to Indeterminate
  672. recursor_1 | Oct 21 15:12:40 [1] QM m.root-servers.net.|A child=(empty): Step0 Found in cache
  673. recursor_1 | Oct 21 15:12:40 [1] Nameserver m.root-servers.net IPs: 202.12.27.33(0.00ms)
  674. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Resolved '.' NS m.root-servers.net to: 202.12.27.33
  675. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Trying IP 202.12.27.33:53, asking 'thux.lan|DS'
  676. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Adding EDNS Client Subnet Mask 127.0.0.1/32 to query
  677. recursor_1 | Oct 21 15:12:40 [1] thux.lan: Got 7 answers from m.root-servers.net (202.12.27.33), rcode=3 (Non-Existent domain), aa=1, in 37ms
  678. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|SOA|a.root-servers.net. nstld.verisign-grs.com. 2021102100 1800 900 604800 86400' from '.' nameservers? ttl=86400, place=2 YES!
  679. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|SOA 8 0 86400 20211103050000 20211021040000 14748 . C3nPeFjtJetiZFv/QPWucfhyNXFZLZcai8RENII3RaVVZwuAzVyK5A5xn9Q/foXCZn9vvxBv+OhJuqjYCgZLHdQY0Bbr3O0DNKm693uV+DjJXwTFv49ahBd8898NveSljUXod1atynEjyS7Lh3t17ByT1BrI+5teZaRyeRuievyFNy55Lat71j/mB7zssgOxzXRi2QuZinr3bxLCmzkAWiYeeY8oiqobd4F/1qgN9pp5KtpXMECCHtdkHyvIIrzQkoRUJD1fdELU+oBIrwsKjtMq+96YLnkXOw9GSDbJgRtNmc3Qho4jN87UlaCWGAaQrNo9g9TubeZCGwQ22hnvrg==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  680. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|NSEC|aaa. NS SOA RRSIG NSEC DNSKEY' from '.' nameservers? ttl=86400, place=2 YES!
  681. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer '.|RRSIG|NSEC 8 0 86400 20211103050000 20211021040000 14748 . NLM7Oixo1va6ZwZrUyA82+FBtQNZKgWQyvfJbm0JdslmUV9RSbe/FXxu5+P7Uvxm2lRTuo0+0Ie0T2AP0pytvQNxlZ0h6vDDe3kDRGR69CsOIRyTs6pLC7QQB0QVT+5i8xZuYKfFNXFP0WWCRBTtQahvmLTpGgR2KY4mA3jLzqoq9DR8tzQf6m6XciW4ZES3ZZOJNGpi+yifi5W9yRKbU8F1VWZ3iMKb5sJBgUi8NTDHVJEu5diLaePvLKp4XBZDim0FYaPqm1S57I7nZwMgfcwcWhty54Jo5icA/ZsjFYvhohuJ87zuctNa7PjMH/xLOkyZs/lh1J894+Cm8s2i3A==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  682. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|NSEC|lancaster. NS DS RRSIG NSEC' from '.' nameservers? ttl=86400, place=2 YES!
  683. recursor_1 | Oct 21 15:12:40 [1] thux.lan: accept answer 'lamer|RRSIG|NSEC 8 1 86400 20211103050000 20211021040000 14748 . FcySTzLbe0gfOxl7iex8zzEl0BDzjRPUsXafwmShHKUXkdJ/eBNqJNxIoP+1e5sqKoUA+YfIlDRwC7FqkzVkZpLKaWhOn7N0nJtBaS7QLLZl3E+LJK05STfzNYJiePCVVl/BwNHyTMVWbITuJlS+U17o6kq6ckpiPCg+zOxIdAfMxK644TtD7DPFj0s3ZfJdOm16vsSeuqz7uj4Tw5bcRNi+dvVxTajdjXrd2Jyy9yB2LluVw56a0YjXN8CT3+LgVsObwpJlbxWFLG7e3K/ZFaU3lvtA8VfEJjw1al2Epljez34pD8DH9a+mTZQsBkW6chmm6g1pijQLSg/C0wr2vA==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  684. recursor_1 | Oct 21 15:12:40 [1] thux.lan: OPT answer '.' from '.' nameservers
  685. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  686. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|SOA
  687. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional SOA record for .
  688. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  689. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  690. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  691. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  692. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  693. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  694. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  695. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  696. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  697. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  698. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|SOA
  699. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  700. recursor_1 | Oct 21 15:12:40 Validated ./SOA
  701. recursor_1 | Oct 21 15:12:40 [1] Secure!
  702. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Indeterminate
  703. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Secure, validation state is now Secure
  704. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  705. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record .|NSEC
  706. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for .
  707. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  708. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  709. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  710. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  711. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  712. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  713. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  714. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  715. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  716. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  717. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for .|NSEC
  718. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  719. recursor_1 | Oct 21 15:12:40 Validated ./NSEC
  720. recursor_1 | Oct 21 15:12:40 [1] Secure!
  721. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  722. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Secure for record lamer|NSEC
  723. recursor_1 | Oct 21 15:12:40 [1] Validating non-additional NSEC record for lamer
  724. recursor_1 | Oct 21 15:12:40 [1] retrieving the DNSKEYs for .
  725. recursor_1 | Oct 21 15:12:40 [1] Retrieving DNSKeys for .
  726. recursor_1 | Oct 21 15:12:40 [1] : got TA for '.'
  727. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): doResolve
  728. recursor_1 | Oct 21 15:12:40 [1] .: Wants DNSSEC processing, auth data in query for DNSKEY
  729. recursor_1 | Oct 21 15:12:40 [1] .: Recursion not requested for '.|DNSKEY', peeking at auth/forward zones
  730. recursor_1 | Oct 21 15:12:40 [1] .: Found cache hit for DNSKEY: 256 3 8 AwEAAY+oUaY0b7Z45vRD1ef/GykZqgHJtfdzRcnQNvGVQAqlH22QChtG+n1EMugw7T/6uDBAGlRIkXASdtHXhxStb9lPpyQe5/JIuMIlg+NhxKxEJ5e3J9SSPCavvDhH/BPrBCJwn8b68QAWRjVW6Rgdx63pUm7lfsimiWGMfplHNvcZWgVbKA9OI2o2lU8rT8n7zuwtlZPNpDLSI5GzrJgIiKR2Id16fmAgTJBOw14Xye/t4/BxTdxeMiiVFwA4KUV2VeqspHKSHFOz+lUIIqBRknEmYpSvnxnyi0n1n4tGnGP8z6ZwRACi1Rw0nCu7BGOU9M6LpInRoW/W4KXLODr6xqU=[ttl=86379] 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=[ttl=86379]
  731. recursor_1 | Oct 21 15:12:40 [1] .: updating validation state with cache content for . to Secure
  732. recursor_1 | Oct 21 15:12:40 [1] QM .|DNSKEY child=(empty): Step0 Found in cache
  733. recursor_1 | Oct 21 15:12:40 [1] Retrieved 2 DNSKeys for ., state is Secure
  734. recursor_1 | Oct 21 15:12:40 [1] Going to validate 1 record contents with 1 sigs and 2 keys for lamer|NSEC
  735. recursor_1 | Oct 21 15:12:40 signature by key with tag 14748 and algorithm RSASHA256 was valid
  736. recursor_1 | Oct 21 15:12:40 Validated lamer/NSEC
  737. recursor_1 | Oct 21 15:12:40 [1] Secure!
  738. recursor_1 | Oct 21 15:12:40 [1] Validation result is Secure, current state is Secure
  739. recursor_1 | Oct 21 15:12:40 [1] thux.lan: determining status after receiving this packet
  740. recursor_1 | Oct 21 15:12:40 [1] thux.lan: got negative caching indication for name 'thux.lan' (accept=1), newtarget='(empty)'
  741. recursor_1 | Oct 21 15:12:40 [1] : got status Secure for name .
  742. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  743. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  744. recursor_1 | Oct 21 15:12:40 Did not deny existence of TYPE0, .?=thux.lan, 0, next: aaa
  745. recursor_1 | Oct 21 15:12:40 Do have: lamer/NSEC
  746. recursor_1 | Oct 21 15:12:40 lancaster. NS DS RRSIG NSEC
  747. recursor_1 | Oct 21 15:12:40 thux.lan is covered by (lamer to lancaster) but we do need a wildcard proof so looking for NO wildcard proof
  748. recursor_1 | Oct 21 15:12:40 Trying to prove that there is no wildcard for thux.lan/TYPE0
  749. recursor_1 | Oct 21 15:12:40 Do have: ./NSEC
  750. recursor_1 | Oct 21 15:12:40 aaa. NS SOA RRSIG NSEC DNSKEY
  751. recursor_1 | Oct 21 15:12:40 Comparing owner: . with target: *
  752. recursor_1 | Oct 21 15:12:40 Wildcard is covered
  753. recursor_1 | Oct 21 15:12:40 [1] validation state was Secure, state update is Secure, validation state is now Secure
  754. recursor_1 | Oct 21 15:12:40 [1] thux.lan: status=NXDOMAIN, we are done (have negative SOA)
  755. recursor_1 | Oct 21 15:12:40 [1] thux.lan: failed (res=3)
  756. recursor_1 | Oct 21 15:12:40 [1] QM thux.lan.|DS child=thux.lan: Step3 Final resolve: Non-Existent domain/6
  757. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|DS child=dns1b.thux.lan: Step3 Final resolve: No Error/1
  758. recursor_1 | Oct 21 15:12:40 [1] : - Found cut at dns1b.thux.lan
  759. recursor_1 | Oct 21 15:12:40 [1] : New state for dns1b.thux.lan is Bogus - No RRSIG
  760. recursor_1 | Oct 21 15:12:40 [1] : got initial zone status Bogus - No RRSIG for record dns1b.thux.lan|A
  761. recursor_1 | Oct 21 15:12:40 [1] Skipping validation because the current state is Bogus - No RRSIG
  762. recursor_1 | Oct 21 15:12:40 [1] Validation result is Bogus - No RRSIG, current state is Indeterminate
  763. recursor_1 | Oct 21 15:12:40 [1] validation state was Indeterminate, state update is Bogus - No RRSIG, validation state is now Bogus - No RRSIG
  764. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: determining status after receiving this packet
  765. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: answer is in: resolved to '10.2.201.135|A'
  766. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: status=got results, this level of recursion done
  767. recursor_1 | Oct 21 15:12:40 [1] dns1b.thux.lan: validation status is Bogus - No RRSIG
  768. recursor_1 | Oct 21 15:12:40 [1] QM dns1b.thux.lan.|A child=dns1b.thux.lan: Step3 Final resolve: No Error/1
  769. recursor_1 | Oct 21 15:12:40 Answer to dns1b.thux.lan|A for 10.1.201.111:50681 validates as Bogus - No RRSIG
  770. recursor_1 | Oct 21 15:12:40 Sending out SERVFAIL for dns1b.thux.lan|A because recursor or query demands it for Bogus results
  771. recursor_1 | Oct 21 15:12:40 2 [1/1] answer to question 'dns1b.thux.lan|A': 0 answers, 1 additional, took 6 packets, 164.251 netw ms, 170.306 tot ms, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0, dnssec=Bogus - No RRSIG
  772.  
Advertisement
RAW Paste Data Copied
Advertisement