On Wed, May 27, 2015 at 3:40 PM, Warren Kumari <[email protected]> wrote:
> On Wed, May 27, 2015 at 3:02 PM, Joe Abley <[email protected]> wrote: > > > > > > On 27 May 2015, at 19:14, Warren Kumari wrote: > > > >>> For what it's worth, I have no problem getting a reasonable (negative) > >>> response to ACCOUNTANT/IN/TLSA or SOMETHING.ACCOUNTANT/IN/TLSA from > >>> 156.154.144.195 with EDNS0.DO=1 or without EDNS0. Perhaps I'm special > :-) > > Yah, /I/ know you are special -- but I don't know how 156.154.144.195 > knows you are. > > Can you include a dig (or similar) showing you asking the question and > getting an answer (not a timeout?). I've queried from multiple places > with no love... > > W > > > Here's a transcript of my attempt to query all the NS addresses at accountant for TLSA records (from one location, a datacenter in New Jersey). Quick summary: no response/timeout from all the IPv4 addresses, correct NODATA answers from all the IPv6 addresses. Hmm (and no, the machine originating the queries has working IPv4 and can query other records successfully): $ get-ns-ip accountant. ns1.dns.nic.accountant. 156.154.144.195 ns1.dns.nic.accountant. 2610:a1:1071::c3 ns2.dns.nic.accountant. 156.154.145.195 ns2.dns.nic.accountant. 2610:a1:1072::c3 ns3.dns.nic.accountant. 156.154.159.195 ns3.dns.nic.accountant. 2610:a1:1073::c3 ns4.dns.nic.accountant. 156.154.156.195 ns4.dns.nic.accountant. 2610:a1:1074::c3 ns5.dns.nic.accountant. 156.154.157.195 ns5.dns.nic.accountant. 2610:a1:1075::c3 ns6.dns.nic.accountant. 156.154.158.195 ns6.dns.nic.accountant. 2610:a1:1076::c3 $ get-ns-ip accountant. | while read hostname ip > do > echo ">>> $hostname $ip" > dig @$ip _443._tcp.accountant. TLSA > echo "" > done >>> ns1.dns.nic.accountant. 156.154.144.195 ; <<>> DiG 9.10.1 <<>> @156.154.144.195 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached >>> ns1.dns.nic.accountant. 2610:a1:1071::c3 ; <<>> DiG 9.10.1 <<>> @2610:a1:1071::c3 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45660 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;_443._tcp.accountant. IN TLSA ;; AUTHORITY SECTION: accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189 900 900 604800 86400 ;; Query time: 8 msec ;; SERVER: 2610:a1:1071::c3#53(2610:a1:1071::c3) ;; WHEN: Wed May 27 15:50:11 EDT 2015 ;; MSG SIZE rcvd: 108 >>> ns2.dns.nic.accountant. 156.154.145.195 ; <<>> DiG 9.10.1 <<>> @156.154.145.195 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached >>> ns2.dns.nic.accountant. 2610:a1:1072::c3 ; <<>> DiG 9.10.1 <<>> @2610:a1:1072::c3 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8407 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;_443._tcp.accountant. IN TLSA ;; AUTHORITY SECTION: accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189 900 900 604800 86400 ;; Query time: 79 msec ;; SERVER: 2610:a1:1072::c3#53(2610:a1:1072::c3) ;; WHEN: Wed May 27 15:50:27 EDT 2015 ;; MSG SIZE rcvd: 108 >>> ns3.dns.nic.accountant. 156.154.159.195 ; <<>> DiG 9.10.1 <<>> @156.154.159.195 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached >>> ns3.dns.nic.accountant. 2610:a1:1073::c3 ; <<>> DiG 9.10.1 <<>> @2610:a1:1073::c3 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46624 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;_443._tcp.accountant. IN TLSA ;; AUTHORITY SECTION: accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189 900 900 604800 86400 ;; Query time: 8 msec ;; SERVER: 2610:a1:1073::c3#53(2610:a1:1073::c3) ;; WHEN: Wed May 27 15:50:42 EDT 2015 ;; MSG SIZE rcvd: 108 >>> ns4.dns.nic.accountant. 156.154.156.195 ; <<>> DiG 9.10.1 <<>> @156.154.156.195 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached >>> ns4.dns.nic.accountant. 2610:a1:1074::c3 ; <<>> DiG 9.10.1 <<>> @2610:a1:1074::c3 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21156 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;_443._tcp.accountant. IN TLSA ;; AUTHORITY SECTION: accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189 900 900 604800 86400 ;; Query time: 8 msec ;; SERVER: 2610:a1:1074::c3#53(2610:a1:1074::c3) ;; WHEN: Wed May 27 15:50:57 EDT 2015 ;; MSG SIZE rcvd: 108 >>> ns5.dns.nic.accountant. 156.154.157.195 ; <<>> DiG 9.10.1 <<>> @156.154.157.195 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached >>> ns5.dns.nic.accountant. 2610:a1:1075::c3 ; <<>> DiG 9.10.1 <<>> @2610:a1:1075::c3 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56808 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;_443._tcp.accountant. IN TLSA ;; AUTHORITY SECTION: accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189 900 900 604800 86400 ;; Query time: 13 msec ;; SERVER: 2610:a1:1075::c3#53(2610:a1:1075::c3) ;; WHEN: Wed May 27 15:51:12 EDT 2015 ;; MSG SIZE rcvd: 108 >>> ns6.dns.nic.accountant. 156.154.158.195 ; <<>> DiG 9.10.1 <<>> @156.154.158.195 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached >>> ns6.dns.nic.accountant. 2610:a1:1076::c3 ; <<>> DiG 9.10.1 <<>> @2610:a1:1076::c3 _443._tcp.accountant. TLSA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40030 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;_443._tcp.accountant. IN TLSA ;; AUTHORITY SECTION: accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189 900 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 2610:a1:1076::c3#53(2610:a1:1076::c3) ;; WHEN: Wed May 27 15:51:27 EDT 2015 ;; MSG SIZE rcvd: 108 -- Shumon Huque
_______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
