> This has just got a lot worse. As of about 20 minutes ago I've had to > completely disable dnssec validation on my NetBSD 8.1-stable servers > as I had a complete loss of name resolution. Every domain was failing > to resolve (e.g www.google.com). This was with dnssec-validation set > to auto. After setting this to off all dns resolution immediately > started working again.
I can't fully explain that, I'm afraid. The /etc/named.conf shipped in netbsd-8 also contains the "new" root key which is still in use to this day, so that part should be OK. The only similar thing I have experienced is that if your local clock is way off you can get similar symptoms (yes, the coin cell keeping my RTC running is apparently "out of juice" on at least one of my old machines), since DNSSEC signatures have validity intervals which relate to "real timestamps", and if your clock is outside of the validity interval, DNS name resolution (and in particular DNSSEC validation) will fail with SERVFAIL being returned as the error code to the client. Regards, - Håvard
