Re: [dns-operations] Assistance Request: OpenDNS Not Resolving Certain .realtor™ Domains

[Borja Marcos]

> On 1 Dec 2025, at 18:42, Matthew Embrescia via dns-operations <dns-operations at dns-oarc.net> wrote:
> 
> Over the past week, we’ve received multiple reports from customers indicating that some .realtor™ domains (for example, hlaor.realtor) are failing to resolve through OpenDNS, while resolving normally across most other major recursive resolvers, including Google Public DNS, Cloudflare, and Quad9.
>     • The issue appears limited to specific recursive resolvers within OpenDNS, suggesting a potential caching or validation inconsistency.

Maybe major public DNS services are resolving it, but ours (ISP, only for customers) don’t. And we run ISC Bind. Which means anyone using the same software will also have issues.

My home installation of Bind doesn’t like it either. I am running 9.20.16. It is an up to date version.




<150>1 2025-12-03T09:37:13.633846+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.633Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2610:a1:1010::3#53
<150>1 2025-12-03T09:37:13.647738+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.647Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2001:502:2eda::3#53
<150>1 2025-12-03T09:37:13.661814+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.661Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2001:502:ad09::3#53
<150>1 2025-12-03T09:37:13.698082+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.698Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2401:fd80:407::122#53
<150>1 2025-12-03T09:37:13.727430+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.727Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2610:a1:1009::3#53
<150>1 2025-12-03T09:37:13.766187+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.766Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2a01:618:403::122#53
<150>1 2025-12-03T09:37:13.803650+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.803Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2401:fd80:403::122#53
<150>1 2025-12-03T09:37:13.838599+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.838Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 2a01:618:407::122#53
<150>1 2025-12-03T09:37:13.848658+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.848Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 156.154.103.3#53
<150>1 2025-12-03T09:37:13.858406+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.858Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 156.154.101.3#53
<150>1 2025-12-03T09:37:13.868425+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.868Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 156.154.100.3#53
<150>1 2025-12-03T09:37:13.900870+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.900Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 43.230.51.122#53
<150>1 2025-12-03T09:37:13.928226+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.928Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 156.154.102.3#53
<150>1 2025-12-03T09:37:13.969601+00:00 elnuc named 50456 - - 2025-12-03T09:37:13.969Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 213.248.219.122#53
<150>1 2025-12-03T09:37:14.000229+00:00 elnuc named 50456 - - 2025-12-03T09:37:14.000Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 103.49.83.122#53
<150>1 2025-12-03T09:37:14.031666+00:00 elnuc named 50456 - - 2025-12-03T09:37:14.031Z lame-servers: no valid RRSIG resolving 'hlaor.realtor/DS/IN': 213.248.223.122#53
<150>1 2025-12-03T09:37:14.032249+00:00 elnuc named 50456 - - 2025-12-03T09:37:14.032Z lame-servers: broken trust chain resolving 'hlaor.realtor/A/IN': 2600:9000:5307:2f00::1#53
<151>1 2025-12-03T09:37:14.032415+00:00 elnuc named 50456 - - 2025-12-03T09:37:14.032Z query-errors: client @0x802e6c000 127.0.0.1#63583 (hlaor.realtor): query failed (broken trust chain) for hlaor.realtor/IN/A at query.c:7848


Cheers,





Borja.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: Message signed with OpenPGP
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20251203/11afbd39/attachment.sig>