On Wed, 15 Jul 2026 07:08:04 +0000 Andy Smith <[email protected]> wrote:
> > What does: > > dig +trace -x 82.195.75.100 @192.168.71.8 > > output? > > It will show you each step of the recursive resolving. > > Do note that part of this recursion uses DNSSEC. If validation fails > for some reason then SERVFAIL is the usual outcome. BIND9 as a > resolver does do DNSSEC validation by default, whereas your ISP > router's resolver probably does not. So your DNSSEC validation setup > may be iffy. joe@jrenewsid:~$ sudo dig +trace -x 82.195.75.100 @192.168.71.8 ; <<>> DiG 9.20.24-1+b1-Debian <<>> +trace -x 82.195.75.100 @192.168.71.8 ;; global options: +cmd 468193 IN NS l.root-servers.net. . 468193 IN NS d.root-servers.net. . 468193 IN NS f.root-servers.net. . 468193 IN NS h.root-servers.net. . 468193 IN NS j.root-servers.net. . 468193 IN NS b.root-servers.net. 468193 IN NS a.root-servers.net. . 468193 IN NS e.root-servers.net. . 468193 IN NS m.root-servers.net. . 468193 IN NS g.root-servers.net. . 468193 IN NS i.root-servers.net. . 468193 IN NS c.root-servers.net. .468193 IN NSk.root-servers.net. . 468193 IN RRSIG NS 8 0 518400 20260727190000 20260714180000 57780 . 1qLr5dmWdIvW7LA3BF+R/+O4gdMyZot2CdXC6TFDc9mq+pwbXvnFBeg X uR1pqR2ZUvWQm6Sgnbyra0BobPh+uAY0fZVfX6HvNZxeLDIkRNuz0qow 0NTBiu7dM122k+l66s6u6mIn0ApAmUloJs4k1b5qhNXnfLCufvcxmSJk LmebGMJAumT1F608zvuxOaZ7tcTE5Puios6H/fB rR2aXWxXiewYqfj98 gzeZ42jKjYYJMiz8P6QK5iOFN37a4ARqFFiIG8OPXPQJ31jOTN9v38h8 ApvHVEpexuV/WsVbKWiXGoxUmxynv1/bSV71UnbBEEeRDFPgkaKVSXul /ZouAw== ;; Received 1137 bytes from 192.168.71.8#53(192.168.71.8) in 4 ms ;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for 100.75.195.82.in-addr.arpa. failed: network unreachable. ;; no servers could be reached ;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for 100.75.195.82.in-addr.arpa. failed: network unreachable. ;; no servers could be reached ;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for 100.75.195.82.in-addr.arpa. failed: network unreachable. ;; UDP setup with 2001:500:a8::e#53(2001:500:a8::e) for 100.75.195.82.in-addr.arpa. failed: network unreachable. in-addr.arpa. 172800 IN NS a.in-addr-servers.arpa. in-addr.arpa. 172800 IN NS e.in-addr-servers.arpa. in-addr.arpa. 172800 IN NS c.in-addr-servers.arpa. in-addr.arpa. 172800 IN NS d.in-addr-servers.arpa. in-addr.arpa. 172800 IN NS b.in-addr-servers.arpa. in-addr.arpa. 172800 IN NS f.in-addr-servers.arpa. in-addr.arpa. 86400 IN DS 47054 8 2 5CAFCCEC201D1933B4C9F6A9C8F51E51F3B39979058AC21B8DF1B1F2 81CBC6F2 in-addr.arpa. 86400 IN DS 54956 8 2 E0E2BF5CFBD66572CA05EC18267D91509BA6A9405AF05C3FD4141DFA 45200C08 in-addr.arpa. 86400 IN DS 53696 8 2 13E5501C56B20394DA921B51412D48B7089C5EB6957A7C58553C4D4D 424F04DF in-addr.arpa. 86400 IN DS 63982 8 2 AAF4FB5D213EF25AE44679032EBE3514C487D7ABD99D7F5FEC3383D0 30733C73 in-addr.arpa. 86400 IN RRSIG DS 8 2 86400 20260727180000 20260714170000 39561 arpa. ggoV/lumzdcvYdHm0Pm1nFSsHMBUEIYLd1kZHfIk9cD9sRadr9na iJb0 6nuPbt2UaW64gZvBs1OjCGmSM/gwVTdJj3gtOMdyXaxwb0ebYwhrrzBf ckDVLwkZd3wKfs/Ym6gb1zrrNPCNyNQKpXkhsLnukCx4TG2YIBxuH0KR 1cg7fyrZ63kLKmIks4dCmNUUV76u9OnrCQcW 05qSvsgopIOfoHjhlq1H KxfpdVPJwPMGnFBIHhtYGEimYt4W5CKBQ5RCd6rEJQ5IE+Vn0mH8oWbL E9SdMJ5rbN7144vh0rHeHdGhu9tM6FmOvsg15k5q6BiGyQy29RagK7OX BVFsmA== ;; Received 943 bytes from 192.33.4.12#53(c.root-servers.net) in 16 ms ;; UDP setup with 2001:43f8:110::10#53(2001:43f8:110::10) for 100.75.195.82.in-addr.arpa. failed: network unreachable. 82.in-addr.arpa. 86400 IN NS ns3.lacnic.net. 82.in-addr.arpa. 86400 IN NS ns3.afrinic.net. 82.in-addr.arpa. 86400 IN NS ns4.apnic.net. 82.in-addr.arpa. 86400 IN NS pri.authdns.ripe.net. 82.in-addr.arpa. 86400 IN NS rirns.arin.net. 82.in-addr.arpa. 86400 IN DS 64189 13 2 C1D0F2EB646A851553495E12567C265C5DB9811C61C822DA5C5BD6A6 7F38C2B4 82.in-addr.arpa. 86400 IN RRSIG DS 8 3 86400 20260801224726 20260712091556 31765 in-addr.arpa. IfRj517uDX81sM2h0alT+sxvuypq7XJVMmTbAoVpnUEc CJ1h1LLLluyJ EWm4NxMn3G4UyQ24/Pn8AzD4FQcUJD/Z8RuI1DavhcvVxTZehvIxhcSW 3AUjmiVuT4xMdzfL9hcnN6d9ntuKjJLRsGnl6n3hAK7y/tcRsYIG8TFN hdI= ;; Received 409 bytes from 193.0.9.1#53(f.in-addr-servers.arpa) in 8 ms 75.195.82.in-addr.arpa. 86400 IN NS ns2.man-da.de. 75.195.82.in-addr.arpa. 86400 IN NS ns3.man-da.de. 75.195.82.in-addr.arpa. 86400 IN NS ns1.man-da.de. 75.195.82.in-addr.arpa. 3600 IN DS 57319 13 2 03644989133634C2E95982379AA9C243FE48125F67AC7039BF0E4B1B 82477E22 75.195.82.in-addr.arpa. 3600 IN RRSIG DS 13 5 3600 20260727095121 20260713082121 64189 82.in-addr.arpa. ppXKEizvrNkimlP6xhfuVBNgGVLQ2UqBPNHe7NiTL DI2849NOsXnehYo zUn34MRuGqzp1WZoaHzDIuxlCFQCtA== ;; Received 305 bytes from 202.12.31.53#53(ns4.apnic.net) in 216 ms ;; Connection to 2001:4c80:0:7f1::249#53(2001:4c80:0:7f1::249) for 100.75.195.82.in-addr.arpa. failed: network unreachable. ;; Connection to 2001:41b8:0:18::10#53(2001:41b8:0:18::10) for 100.75.195.82.in-addr.arpa. failed: network unreachable. 100.75.195.82.in-addr.arpa. 3600 IN CNAME 100.64-26.75.195.82.in-addr.arpa. 100.75.195.82.in-addr.arpa. 3600 IN RRSIG CNAME 13 6 3600 20260725072209 20260711055209 25684 75.195.82.in-addr.arpa. e7FvHXk4Bqz9JLxenWVC4CDMZCj5wsD NfqrAD1Au67FcttQtcJJQGwZi YnyXONXn2HfYMcAvw8wOT4VjMWi0Fw== 64-26.75.195.82.in-addr.arpa. 3600 IN NS rns1.debian.org. 64-26.75.195.82.in-addr.arpa. 3600 IN NS rns2.debian.com. 64-26.75.195.82.in-addr.arpa. 3600 IN NS rns3.debian.org. 64-26.75.195.82.in-addr.arpa. 3600 IN NS rns4.debian.com. lp0k9coo0o6pt6r38q4jtplcdsuf9tai.75.195.82.in-addr.arpa. 86400 IN NSEC3 1 0 0 - LU919LMT93UQJRQO6A2ETA4E84SMOAQ0 NS lp0k9coo0o6pt6r38q4jtplcdsuf9tai.75.195.82.in-addr.arpa. 86400 IN RRSIG NSEC3 13 6 86400 20260725072209 20260711055209 25684 75.195.82.in-addr.arpa. yFEvhq OdRcFNZ8eDHY0MQ1DOYEOoNqqJ0z1wQUzRYjB1f2dOrw4mhNQl fgtWoKmxj0fpd/ORnKANNEDllwux7g== ;; Received 511 bytes from 82.195.66.249#53(ns1.man-da.de) in 28 ms Success despite some problems on the way. > > Anything in bind9's logs? Nothing, with trace used. Without it: Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'pri.authdns.ripe.net/A/IN': 2001:dd8:12::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'pri.authdns.ripe.net/A/IN': 2620:38:2000::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'pri.authdns.ripe.net/AAAA/IN': 2620:38:2000::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/A/IN': 2001:13c7:7002:3000::10#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/AAAA/IN': 2001:13c7:7002:3000::10#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving '195.82.in-addr.arpa/NS/IN': 2620:38:2000::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/A/IN': 2001:dd8:12::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/AAAA/IN': 2620:38:2000::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2801:1b8:10::b#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2801:1b8:10::b#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/A/IN': 2620:38:2000::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/AAAA/IN': 2001:13c7:7002:3000::11#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:7fe::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:7fe::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'ns3.lacnic.net/A/IN': 2001:13c7:7002:3000::11#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:503:c27::2:30#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:503:c27::2:30#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:500:2f::f#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:500:2f::f#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:500:9f::42#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:500:9f::42#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:dc3::35#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:dc3::35#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:503:ba3e::2:30#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:503:ba3e::2:30#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:7fd::1#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:7fd::1#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:500:12::d0d#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving '75.195.82.in-addr.arpa/NS/IN': 2a13:27c0:30::5#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:500:12::d0d#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:500:1::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/AAAA/IN': 2001:500:1::53#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a2.org.afilias-nst.info/A/IN': 2001:7fd::1#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a0.org.afilias-nst.info/A/IN': 2001:7fd::1#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a2.org.afilias-nst.info/A/IN': 2001:500:9f::42#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a2.org.afilias-nst.info/AAAA/IN': 2001:500:9f::42#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a0.org.afilias-nst.info/A/IN': 2001:500:9f::42#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a0.org.afilias-nst.info/AAAA/IN': 2001:500:9f::42#53 Jul 15 11:35:09 piserve1 named[3722]: network unreachable resolving 'a.lactld.org/A/IN': 2001:500:48::1#53 Presumably the router is forwarding to the ISP's master caching DNS server, which isn't having problems. But it looks as if the trouble is outside my network, and there's nothing I can do to fix it without forwarding to the ISP's server myself. I don't like using router DNS, once I had some trouble sending email to a few people which turned out to be the router not finding an MX record for a few domains. Since then I've used root hints. I still don't understand why I had no trouble with (presumably an older) BIND9 on the Microserver. Maybe a clue: my ISP doesn't yet do IPv6, though I can't see why that should affect a DNS enquiry for an IPv4 address. -- Joe
