[dns-operations] Dealing with the bizarre - grantee.fema.gov

[Brian Somers]

On Jul 8, 2020, at 12:22 PM, Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:
> 
>> 
>> No. My BIND and Unbound personal resolvers (which do not have a NTA)
>> get a reply and set AD.
> 
> There are probably several different instances for each authoritative
> server of grantee.fema.gov, and they behave differently. Here, seen by
> the RIPE Atlas probes, you can se that some probes can get a DNSKEY
> (when using the DO bit) and some cannot (timeout):

Yes, I believe this is true.

If I query from San Jose or Vancouver I get the timeout.  But querying from a
machine in the UK provides an answer.

—
Brian