[dns-operations] Google Public DNS

[Adam King]

Potentially, whatever the problem was it all seems to be fixed today. 

dig @8.8.8.8 icann.org

; <<>> DiG 9.5.1-P2 <<>> @8.8.8.8 icann.org
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62912
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;icann.org.                     IN      A

;; ANSWER SECTION:
icann.org.              600     IN      A       192.0.43.7

;; Query time: 300 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct  4 08:43:20 2012
;; MSG SIZE  rcvd: 43

dig @8.8.8.8 icann.org +dnssec +multiline

; <<>> DiG 9.5.1-P2 <<>> @8.8.8.8 icann.org +dnssec +multiline
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57875
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;icann.org.             IN A

;; ANSWER SECTION:
icann.org.              600 IN A 192.0.43.7
icann.org.              600 IN RRSIG A 7 2 600 20121011073523 (
                                20121003202551 3728 icann.org.
 
l3b0HGwHvyCPSwh1E1kDCuKoVatxfUK0d2bQX0jQ2onz
 
40UKDp/VwKgv6t5KgB2G9ES1KM/u8YgISKyjwsok3buT
 
5DHAAUwqO+hxA/D4hzzbsMeXLMuDMg2TUqbnh6qgag9L
                                73HN8xOJQrb/mTASyTzv5O8vZLPc1CQ0l84rOR0= )

;; Query time: 418 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct  4 08:45:37 2012
;; MSG SIZE  rcvd: 223

Adam.


-----Original Message-----
From: Joe Abley [mailto:jabley at hopcount.ca] 
Sent: Thursday, 4 October 2012 2:14 AM
To: Adam King
Cc: dns-operations at lists.dns-oarc.net
Subject: Re: [dns-operations] Google Public DNS


On 2012-10-02, at 18:41, Adam King <adam.king at auda.org.au> wrote:

> I am receiving SERVFAIL from both 8.8.8.8 or 8.8.4.4 for specific
domains
> (icann.org, ietf.org, isc.org)

Just out of interest, are all the domains you're seeing (or you saw)
problems with signed?

Perhaps you're seeing an engineering/pre-production test of DNSSEC
validation at Google, and there are still kinks to iron out.


Joe