<div dir="ltr">I have a zone where keys are currently in rotation[1], with the old keys (both KSK and ZSK) at 1024 bits and the new keys (both KSK and ZSK) at 2048 bits [2]. DNSSEC validating resolvers such as Google's public resolvers are currently returning SERVFAIL. [3]<div><br></div><div>I am trying to determine why the lookups are failing at resolvers. Is this due to the truncation and requirement to switch to TCP? Do I need to reduce the bit size to something between 1024 and 2048?</div><div><br></div><div>Thanks!</div><div><br></div><div>-Anthony</div><div><div><br></div><div>[1] DS lookup</div><div><br></div><div><div>; <<>> DiG 9.12.1 <<>> <a href="http://avisi.net">avisi.net</a> ds</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54679</div><div>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 512</div><div>;; QUESTION SECTION:</div><div>;<a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DS</div><div><br></div><div>;; ANSWER SECTION:</div><div><a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>86399<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DS<span style="white-space:pre"> </span>43144 8 2 FCED288098D07789ECF678130AB7067A0B4BC6A32AEB3CF6CBEDA915 BB17FAEF</div><div><a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>86399<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DS<span style="white-space:pre"> </span>814 8 2 55C0CDFA96D35060D4A16E747D4C82550BDF773684DEE151E798F7A8 D60BDF15</div><div><br></div><div>;; Query time: 48 msec</div><div>;; SERVER: 8.8.8.8#53(8.8.8.8)</div><div>;; WHEN: Fri Jun 15 13:19:23 CEST 2018</div><div>;; MSG SIZE rcvd: 134</div><div><div><br></div><div>[2] DNSKEY lookup at authoritative</div><div><br></div><div>; <<>> DiG 9.12.1 <<>> @<a href="http://ns1.dnsimple.com">ns1.dnsimple.com</a> <a href="http://avisi.net">avisi.net</a> dnskey</div><div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53736</div><div>;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1</div><div>;; WARNING: recursion requested but not available</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 65535</div><div>;; QUESTION SECTION:</div><div>;<a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DNSKEY</div><div><br></div><div>;; ANSWER SECTION:</div><div><a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>3600<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DNSKEY<span style="white-space:pre"> </span>256 3 8 AwEAAdGV37X55G9mrcdE5aGnGD8TN+3nL0Bh1tUor0Y2m/dzi+fw9mnc yxPEm+YXfq2fk0m0UCq/pUCKGJ3h+YJPiRayJnNGaqdrf5+N/sD3FkBV K/XbyxAJo6x+WmEIqLAG86X3CS/aLaMcJggABHbQvANgaCn0hRadSDnF pRwAKGJN</div><div><a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>3600<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DNSKEY<span style="white-space:pre"> </span>256 3 8 AwEAAe28LyXeKkCAPssNxjizQV7tltdf7PbE/N9Cz+znIWq+cIqKS1th mOzCLSmvOfTCL3NuACotz5lmtshGrCrKTtUX6c29UZyqDGi+5CuioL81 is9SRdBZWCQMxHV7CmvXz/8CI5jfdNMKoIh1x3sq5YLe3P41HZL7PZAV DSWrNmEf</div><div><a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>3600<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DNSKEY<span style="white-space:pre"> </span>257 3 8 AwEAAcdQiEoApNVhI9tnxpvwZOsVuskjGprvOm5l/eFaMGT8MEnf8iNd Qn8GPpmMMPyiLtby8u/NGKwMquqN+GC8vNxtL6X1aH56qk6CQ8hw0gzj tq7U7upD2aatzUyGM1pQg8mLyZmDxDOV7Go8+O7PeAzkd1MZk3O+OWft DqEQ8daATqT+nFep7C5RB+UGch3oIKP/kgHQcOSkcYY5t/h07XmqjpcC PbR9ckhd7KnYgoigM4Pxy1gNbdffdlYqMCrv3j8k8BxdFkoYJAYwdwl8 s/mKFtH1wMInSSWrC3S57SbB5duvmutnhj6lfi+gpZpz9PLSNDl3WW+S hR/RXSMd8DM=</div><div><a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>3600<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DNSKEY<span style="white-space:pre"> </span>257 3 8 AwEAAckqvGwehFdAuYYb+b8IgXEtgcsfeVRMfk2jde7WfXOMFwIwT8pH HOY0QXUNx0OFU5L9f2sMxWTUvp8EyW+F/lLgENBjDUzeUzMWMPp+EQUM TJKAwE3rnUTx8Zow6uZTy7FO6KvAI2wVi5KN0b7jXZZ97Z8S5uZ7S8Go wt4t+fthOgQ/mPW7vVbvZSo5v3H7dqBFgIQGXgjsggCQeoSxS528pge/ 4ii4nx7TsbntAYBqfovIu3g46l2/nnOuUoNE7aOKYvC7SKPmrpAfnUUL j5E7704shGOM38XPOTvAkSl9NyqGM4ln0LgiFYLxO/m2tN0ySQVS4A5A SHFdR0Ai64E=</div><div><br></div><div>;; Query time: 50 msec</div><div>;; SERVER: 162.159.24.4#53(162.159.24.4)</div><div>;; WHEN: Fri Jun 15 13:17:21 CEST 2018</div><div>;; MSG SIZE rcvd: 886</div><div><br></div><div>[3] DNSKEY lookup at resolver</div><div><br></div><div><div>; <<>> DiG 9.12.1 <<>> @<a href="http://8.8.8.8">8.8.8.8</a> <a href="http://avisi.net">avisi.net</a> DNSKEY</div><div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 63216</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 512</div><div>;; QUESTION SECTION:</div><div>;<a href="http://avisi.net">avisi.net</a>.<span style="white-space:pre"> </span>IN<span style="white-space:pre"> </span>DNSKEY</div><div><br></div><div>;; Query time: 3708 msec</div><div>;; SERVER: 8.8.8.8#53(8.8.8.8)</div><div>;; WHEN: Fri Jun 15 13:18:46 CEST 2018</div><div>;; MSG SIZE rcvd: 38</div></div><div><br></div><div><br></div>-- <br><div class="gmail_signature">DNSimple.com<br><a href="http://dnsimple.com/" target="_blank">http://dnsimple.com/</a><br>Twitter: @dnsimple</div>
</div></div></div></div>