Re: [DNSOP] m.root-servers.net DNSSEC TCP failures

[Gilles Massen <[e-mail]>]

It's a bit weird from here:

TCP queries to m's IPv4 adress are working fine:

dns-test:~ # dig @202.12.27.33 . any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.0-P1 <<>> @202.12.27.33 . any
; (1 server found)
;; global options: +cmd
;; Got answer:

And:

dig @202.12.27.33 hostname.bind ch txt +short +tcp
"M-NRT-JPIX-3"

With IPv6 it's pretty strange:

dns-test:~ # dig @2001:dc3::35 . any
;; Truncated, retrying in TCP mode.
<timeout>

BUT:

dns-test:~ # dig @2001:dc3::35 . ns +tcp

; <<>> DiG 9.7.0-P1 <<>> @2001:dc3::35 . ns +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
[...]
;; Query time: 34 msec
;; SERVER: 2001:dc3::35#53(2001:dc3::35)
;; WHEN: Wed Mar 17 13:10:59 2010
;; MSG SIZE  rcvd: 632

dns-test:~ # dig @2001:dc3::35 hostname.bind ch txt +short +tcp
"M-CDG-2"

Actually any query to M with IPv6 and TCP seems to work but ANY.

But dig @2001:dc3::35 . any +bufsize=2048 doesn't work either. Maybe the
IPv6 instance is having MTU/DF issues?

Gilles


Olafur Gudmundsson wrote:
> Here is what I get:
> <stora:~ 7:55 8 0>dig any . @m.root-servers.net.
> ;; Truncated, retrying in TCP mode.
> 
> ; <<>> DiG 9.6.1-P1 <<>> any . @m.root-servers.net.
> 
> Thus I think the any-cast instance you are using is the broken one,
> I'm talking to the one on the west coast of the US. (SFO ?).
> 
> traceroute to m.root-servers.net (202.12.27.33), 64 hops max, 40 byte
> packets
>  ..
>  3  ge-0-0-2.cr2.sfo1.speakeasy.net (69.17.87.18)  98.303 ms  96.415 ms
>  97.783 ms
>  4  rtr0.sfo.m.root-servers.org (198.32.176.179)  100.297 ms  100.138
> ms  97.285 ms
>  5  M.ROOT-SERVERS.NET (202.12.27.33)  99.553 ms  100.397 ms  99.036 ms
> 
>     Olafur
> 
> 
> 
> 
> On 17/03/2010 7:28 AM, George Barwood wrote:
>> It seems that
>>
>> m.root-servers.net
>>
>> is now serving DNSSEC, but does not have TCP, so the following queries
>> all fail
>>
>> dig any . @m.root-servers.net
>> dig rrsig . @m.root-serves.net
>> dig any . @m.root-servers.net +dnssec +bufsize=1400
>>
>> None of these are normal queries, but seems a bit doubtful even so.
>>
>> George

-- 
Fondation RESTENA - DNS-LU
6, rue Coudenhove-Kalergi
L-1359 Luxembourg
tel: [phone]
fax: [phone]