Hi, On Tue, Jul 14, 2026 at 10:14:07PM +0100, Joe wrote: > ISP DNS: > > joe@jrenewsid:~$ dig -x 82.195.75.100
[…] > ;; ANSWER SECTION: > 100.75.195.82.in-addr.arpa. 851 IN CNAME > 100.64-26.75.195.82.in-addr.arpa. > 100.64-26.75.195.82.in-addr.arpa. 851 IN PTR bendel.debian.org. […] > BIND9: > > joe@jrenewsid:~$ dig @192.168.71.8 -x 82.195.75.100 > > ; <<>> DiG 9.20.24-1+b1-Debian <<>> @192.168.71.8 -x 82.195.75.100 > ; (1 server found) > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 31340 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 What does: dig +trace -x 82.195.75.100 @192.168.71.8 output? It will show you each step of the recursive resolving. Do note that part of this recursion uses DNSSEC. If validation fails for some reason then SERVFAIL is the usual outcome. BIND9 as a resolver does do DNSSEC validation by default, whereas your ISP router's resolver probably does not. So your DNSSEC validation setup may be iffy. Anything in bind9's logs? $ delv -x 82.195.75.100 ;; validating 100.64-26.75.195.82.in-addr.arpa/PTR: no valid signature found ; fully validated 100.75.195.82.in-addr.arpa. 3600 IN CNAME 100.64-26.75.195.82.in-addr.arpa. 100.75.195.82.in-addr.arpa. 3600 IN RRSIG CNAME 13 6 3600 20260725072209 20260711055209 25684 75.195.82.in-addr.arpa. e7FvHXk4Bqz9JLxenWVC4CDMZCj5wsDNfqrAD1Au67FcttQtcJJQGwZi YnyXONXn2HfYMcAvw8wOT4VjMWi0Fw== ; unsigned answer 100.64-26.75.195.82.in-addr.arpa. 28799 IN PTR bendel.debian.org. 100.64-26.75.195.82.in-addr.arpa. 28799 IN RRSIG PTR 13 7 28800 20260730021457 20260620015239 49383 64-26.75.195.82.in-addr.arpa. 4IuODtaiusOd4qJu+Ko48jtvhZs3CDFci6hE/fq7+ECHb/waOrl4zu6R Dhb1O6/mj5UfnuLvaklBUbmEVp8uPQ== The above shows that the zone that contains "100.75.195.82.in-addr.arpa" is signed and validates, while the zone that contains "100.64-26.75.195.82.in-addr.arpa" is not signed. This is not an ideal setup but it should work. If your validator is broken it will choke at one of the signed steps. Thanks, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting
