Hi Daniel & everybody I would like to delegate dynamic.estada.ch and everything under it to my second nameserver. It has some nice features like telling you the time: kdig TXT time.dynamic.estada.ch @185.194.239.135 ;; WARNING: response QR bit not set ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 53740 ;; Flags: aa rd ra ad; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 0
;; QUESTION SECTION: ;; time.dynamic.estada.ch. IN TXT ;; ANSWER SECTION: time.dynamic.estada.ch. 18 IN TXT "2026-06-06 19:56:42 UTC" My trouble is maybe with the resolvers, that the recursive resolvers of my mobile ISP is not properly resolving the chain of NS entries? I made another configuration where I move the glue records outside of the tree dynamic.estada.ch up into estada.ch: dynamic.estada.ch. 3600 NS dynamic-ns.estada.ch. dynamic-ns.estada.ch. 3600 A 185.194.239.135 dynamic-ns.estada.ch. 3600 AAAA 2a0a:51c0::12b This appears to be working better with my local ISP, but still is not reliable on a more global scale: https://dnschecker.org/#TXT/time.dynamic.estada.ch I would love to have the old setup where the whole dynamic experiment is contained unter its own dns tree, but I seem to have this weird resolution problem. Because now the website https://dynamic.estada.ch/ is no longer resolved, which is a problem for my letsencrypt setup. Thanks in advance & have a nice weekend, Stefan Am Fr., 5. Juni 2026 um 21:47 Uhr schrieb Daniel Salzman < [email protected]>: > Hi Stefan, > > Maybe I'm overlooking something, but do you have the dynamic.estada.ch > zone configured? > Cannot you simply remove `dynamic.estada.ch. NS dynamic.estada.ch.` > delegation? > > Daniel > > On 6/5/26 17:53, Stefan Estada wrote: > > Hi all > > > > I am having trouble forwarding a subdomain since I upgraded to the > latest knot. > > For a couple of years I have been running a custom DNS server under > dynamic.estada.ch <http://dynamic.estada.ch> that the clients find via my > regular infrastructure. > > > > On my primary zone I have these records, but knot appears to answer > weirdly: > > *estada.ch.zone* > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600 A 185.194.239.135 > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600 AAAA 2a0a:51c0::12b > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600 NS dynamic.estada.ch > <http://dynamic.estada.ch>. > > > > > > > > kdig AAAA dynamic.estada.ch <http://dynamic.estada.ch> @ns1.estada.ch < > http://ns1.estada.ch> > > ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 29173 > > ;; Flags: qr rd; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 3 > > > > ;; EDNS PSEUDOSECTION: > > ;; Version: 0; flags: ; UDP size: 1232 B; ext-rcode: NOERROR > > > > ;; QUESTION SECTION: > > ;; dynamic.estada.ch <http://dynamic.estada.ch>. INAAAA > > > > ;; AUTHORITY SECTION: > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600INNSdynamic.estada.ch > <http://dynamic.estada.ch>. > > > > ;; ADDITIONAL SECTION: > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600INA185.194.239.135 > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600INAAAA2a0a:51c0::12b > > > > > > But public servers don't get the glue records: > > kdig AAAA dynamic.estada.ch <http://dynamic.estada.ch> @9.9.9.9 < > http://9.9.9.9> > > ;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 63899 > > ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1 > > > > ;; EDNS PSEUDOSECTION: > > ;; Version: 0; flags: ; UDP size: 1232 B; ext-rcode: NOERROR > > > > ;; QUESTION SECTION: > > ;; dynamic.estada.ch <http://dynamic.estada.ch>. INAAAA > > > > The trouble is that most resolvers are now unable to resolve the domain > as the AAAA and A queries still get answered with NS + additional A+AAAA. > > Is there a configuration option to tell knot to actually respond with > the A or AAAA record when asked? > > > > Also ANY, TXT, or CAA queries behave the same as NS queries: > > kdig ANY dynamic.estada.ch <http://dynamic.estada.ch> @ns1.estada.ch < > http://ns1.estada.ch> > > ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 14419 > > ;; Flags: qr rd; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 3 > > > > ;; EDNS PSEUDOSECTION: > > ;; Version: 0; flags: ; UDP size: 1232 B; ext-rcode: NOERROR > > > > ;; QUESTION SECTION: > > ;; dynamic.estada.ch <http://dynamic.estada.ch>. INANY > > > > ;; AUTHORITY SECTION: > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600INNSdynamic.estada.ch > <http://dynamic.estada.ch>. > > > > ;; ADDITIONAL SECTION: > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600INA185.194.239.135 > > dynamic.estada.ch <http://dynamic.estada.ch>. 3600INAAAA2a0a:51c0::12b > > > > I am happy for any pointers you may have. > > > > Cheers, > > Stefan > > > > -- > >
--
