Re: [Dnssec-deployment] Intermittent failures for subdomains under nih.gov yesterday

On Wed, Aug 03, 2016 at 08:37:55AM +0200, Roland van Rijswijk - Deij wrote a message of 121 lines which said: > The problem seems to be resolved now, It does not seem so. The DNSKEY RRset of wip.ncbi.nlm.nih.gov is very large (1800 bytes) and the name server

[Dnssec-deployment] Intermittent failures for subdomains under nih.gov yesterday

Hi all, In the hope that someone at NIH is subscribed to this list or someone who knows someone there, willing to nudge them; our resolvers have been reporting validation failures for subdomains under nih.gov since yesterday. The problem seems to be resolved now, but it may be worthwhile doing a

Re: [Dnssec-deployment] Intermittent failures for subdomains under nih.gov yesterday

Hi Stéphane, Stephane Bortzmeyer wrote: > On Wed, Aug 03, 2016 at 08:37:55AM +0200, > Roland van Rijswijk - Deij wrote > a message of 121 lines which said: > >> The problem seems to be resolved now, > > It does not seem so. The DNSKEY RRset of

Re: [Dnssec-deployment] Intermittent failures for subdomains under nih.gov yesterday

I don't have an NIH contact, but it looks like the initial issue was caused when the KSK changed and the DS record in the parent wasn't updated. From about 24 hours ago from the present time: http://dnsviz.net/d/wip.ncbi.nlm.nih.gov/V6CFjw/dnssec/ That issue is now fixed, but the other lingering

Re: [Dnssec-deployment] Intermittent failures for subdomains under nih.gov yesterday

I'd seen the rollover problem too, but not the problems Stéphane mentioned, thanks for reaching out to NIH, hope they pick up on it. Morizot Timothy S wrote: > I don't have an NIH contact, but it looks like the initial issue was caused > when the KSK changed and the DS record in the parent wasn't