-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Leen, Daisuke,
On 06/18/2011 04:56 PM, Daisuke HIGASHI wrote: > Leen Besselink wrote: > >> Is it just me or is Unbound 1.4.7 not able to resolve www.iana.org / > ianawww.vip.icann.org right now ? The reponses for this query, the DNSKEY and the A responses are over 3 Kb. You likely have path MTU trouble. Something is wrong with your fragments. Perhaps you own firewall is set to stop UDP fragments? There is the OARC reply size tester to help with that. The error you see in your logs (I saw your attachments earlier, Leen), are that the system returns very short (0 byte?) UDP datagrams to unbound. Likely because of the UDP fragmentation issues, or less likely because of a server-error at icann.org nameservers. > Unbound with DNSSEC validation not able to resolve www.iana.org. > BIND9 manages to do it but takes long time because of many timeouts. All the time is because of the PMTU trouble. For the server it seems as if the packet has disappeared, and after a while, BIND and unbound attempt to use smaller packets. Where BIND does EDNS@512 (and thus TCP and it works), Unbound does not implement EDNS@512 (it is against standard and people oppose it) and thus turns off EDNS altogether, gets the response but without DNSSEC information, and thus returns SERVFAIL because it fails validation. > It seems that all NS in vip.icann.org returns broken response for > DNSKEY query with UDP. BIND9 retries query with TCP and gets complete > DNSKEY but Unbound does not. Yes, because of the different probe. > Despite vip.icann.org NS are broken, is Unbound behavior correct? > > ------------------ >> dig @gtm1.lax.icann.org vip.icann.org DNSKEY +dnssec > <snip> > ;; connection timed out; no servers could be reached > >> dig @gtm1.lax.icann.org vip.icann.org DNSKEY +tcp +dnssec > <very large DNSKEY RRSet and RRSIG> > ------------------ It is not really possible for unbound to probe the PMTU trouble everywhere; it is not DNS-OARC. If you really have to you can configure a workaround, the edns-size in unbound.conf to 1280 or so and then you have less PMTU trouble. It is better for the internet if you fix the PMTU trouble (on your firewall, or from your provider). Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJN/1CWAAoJEJ9vHC1+BF+N6Y0QAKqwSWgLOjIQPOyikWQm7SAv 3pEjP9/vxhCgS+BTvqYj7exnUX8oa7wjmwLjhW+tqvCjM2eaT0fzx0WgQhWn/MWG 39/WfFZ/v4r8Q70R95TSL44YGbm7q3xnAfL6Fhmv8Dm0b7M1DL1vtsI5mtvv2Ht/ VmvWWP6SJswLdkcut1wRV5ldws6znBDSIJMQn2D0KDqXpn6JiptKl9UfEFQXvhk5 GGP46+EsqvirCblSgIBvX7mU3G5+yuxuozTdzIXWNbzkzKv14nZNSSQL8oU601rI 1cEYsXi3YyuvJq4glmE5f5Q16majIaaHPnLjKtmFt8YEaZKIq/oiK5H1dumy5TVS wQJ0cjT/bF5B8ZmHDW6Bl/20+3P84yPgXOWfqxxOftp0EjqF2R5d9fxD3ZssLiVP 0g61uDBfuVB+03j1Dt61r8mfzlY0NPBkEKZuDpVl8WVS95wDJIjU9g5VxtjUSpq8 Dqii/ev62piAb1nL43BEip2Tq/27BsK8lDPEVE6d8HNqfEqbJzbHaw9lXM5Vbq/2 st41t4GNx0ESqMyKL3bkWHCh2Nnjs64ziInZxJUWKUeh6wSiG+LNWmRrz3suf7sP fX7uV57iDjgNYiSwo6duvBzsf6fEZyE65fDWNK4u8uyc1KIsUQSvtlaUcy4xGn8j yq8Lq26/X2728VVQy5GW =21ef -----END PGP SIGNATURE----- _______________________________________________ Unbound-users mailing list [email protected] http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users
