<div dir="ltr"><div>Hi, to show the extent of the problem in RIPE Atlas:</div><div><br></div><div>$ cat 141962937.txt | goat result -output dnsstat -opt type:A | head<br>21026 "[100.24.208.97 35.172.94.1]"<br>2064 "SERVFAIL"<br>1368 "TIMEOUT"<br>89 "REFUSED"<br>45 "[100.24.208.97 205.251.192.154 205.251.194.208 205.251.197.238 205.251.199.47 35.172.94.1]"<br>30 "FORMERR"<br>23 "[0.0.0.0]"<br>9 "[100.24.208.97 205.251.194.208 205.251.197.238 205.251.199.47 35.172.94.1]"<br>8 "[35.172.94.1]"<br>7 "[100.24.208.97 205.251.192.154 205.251.194.208 205.251.197.238 35.172.94.1]"</div><div><br></div><div><a href="https://atlas.ripe.net/measurements/141962937/">https://atlas.ripe.net/measurements/141962937/</a> (the viz is quite heavy on a browser, but all the data is there if you want to dig deep)</div><div><br></div><div>Cheers,</div><div>Robert</div><div><br></div><div><br></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Dec 3, 2025 at 2:02 AM Viktor Dukhovni <<a href="mailto:ietf-dane@dukhovni.org">ietf-dane@dukhovni.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Mon, Dec 01, 2025 at 05:42:23PM +0000, Matthew Embrescia via dns-operations wrote:<br>
<br>
> Over the past week, we’ve received multiple reports from customers<br>
> indicating that some .realtor domains (for example, hlaor.realtor)<br>
> are failing to resolve through OpenDNS, while resolving normally<br>
> across most other major recursive resolvers, including Google Public<br>
> DNS, Cloudflare, and Quad9.<br>
<br>
Indeed some of the recursive servers are responding with SERVFAIL and an<br>
EDE suggesting a DNSSEC issue:<br>
<br>
- LAX:<br>
<br>
$ for ns in 208.67.22{0,2}.2 2620:0:cc{c,d}::2; do dig +nsid @${ns} hlaor.realtor; done | grep -E 'opcode:|EDE|NSID'<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59550<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 33 30 30 38 2e 6c 61 78 ("r3008.lax")<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20672<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 76 72 31 2e 6c 61 78 ("vr1.lax")<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 7531<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 33 30 31 31 2e 6c 61 78 ("r3011.lax")<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21870<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 33 30 30 38 2e 6c 61 78 ("r3008.lax")<br>
<br>
- MEL:<br>
<br>
$ for ns in 208.67.22{0,2}.2 2620:0:cc{c,d}::2; do dig +nsid @${ns} hlaor.realtor; done | grep -E 'opcode:|EDE|NSID'<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35571<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 34 30 30 32 2e 6d 65 6c 31 ("r4002.mel1")<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53654<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 34 30 30 34 2e 6d 65 6c 31 ("r4004.mel1")<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 11898<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 34 30 30 34 2e 6d 65 6c 31 ("r4004.mel1")<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 5349<br>
; EDE: 6 (DNSSEC Bogus)<br>
; NSID: 72 34 30 30 32 2e 6d 65 6c 31 ("r4002.mel1")<br>
<br>
And ditto for DNSViz for via the same OpenDNS recursive servers:<br>
<br>
<a href="https://dnsviz.net/d/hlaor.realtor/e/3525266/dnssec/" rel="noreferrer" target="_blank">https://dnsviz.net/d/hlaor.realtor/e/3525266/dnssec/</a><br>
<br>
but with the additional detail that the "CD" flag yields success, which<br>
I can also confirm:<br>
<br>
$ for ns in 208.67.22{0,2}.2 2620:0:cc{c,d}::2; do dig +nsid +cd @${ns} hlaor.realtor; done | grep -E 'opcode:|EDE|NSID|^[^;]'<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33629<br>
; NSID: 72 33 30 31 30 2e 6c 61 78 ("r3010.lax")<br>
hlaor.realtor. 3600 IN A 100.24.208.97<br>
hlaor.realtor. 3600 IN A 35.172.94.1<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14743<br>
; NSID: 72 33 30 30 36 2e 6c 61 78 ("r3006.lax")<br>
hlaor.realtor. 3600 IN A 100.24.208.97<br>
hlaor.realtor. 3600 IN A 35.172.94.1<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49680<br>
; NSID: 72 34 30 30 35 2e 6c 61 78 ("r4005.lax")<br>
hlaor.realtor. 3600 IN A 35.172.94.1<br>
hlaor.realtor. 3600 IN A 100.24.208.97<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14934<br>
; NSID: 72 33 30 30 32 2e 6c 61 78 ("r3002.lax")<br>
hlaor.realtor. 3600 IN A 100.24.208.97<br>
hlaor.realtor. 3600 IN A 35.172.94.1<br>
<br>
So most likely for some reason the OpenDNS servers don't like the DS<br>
non-existence proof from the .realtor authoritative servers. Which is<br>
odd, because the DNSKEY and DS records of .realtor haven't changed since<br>
late July 2021.<br>
<br>
If Brian Somers is reading this list and still at Cisco OpenDNS, he<br>
should have a better insight into the nature of the problem.<br>
<br>
-- <br>
Viktor. 🇺🇦 Слава Україні!<br>
<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div>