erro de verificação - consulta ao DNSKEY expirou ou falhou

Navegue suas respostas
1

Estou tentando encontrar a origem de um erro do qual não posso me livrar no depurador dnssec do verisign Depurador da Verisign

Dig consulta o servidor bem 

dig ex-mailer.com ANY @108.61.190.64

Todos os meus logs estão limpos e sem erros no modo de depuração Saída de log

Na verdade, o único sinal de algo errado está em uma captura de pacotes com o que parece ser fragmentação excessiva

OMTUnaminhaplacaderedeéde1500

vtnet0:flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST>metric0mtu1500options=6c03bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,VLAN_HWTSO,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>ether56:00:00:05:53:09inet62001:19f0:6c00:8141::64prefixlen64inet6fe80::5400:ff:fe05:5309%vtnet0prefixlen64scopeid0x1inet108.61.190.64netmask0xffffff00broadcast108.61.190.255nd6options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>media:Ethernet10Gbase-T<full-duplex>status:active

masopmtuparecesurpreso:

ping-s1500-Mdo108.61.190.64From192.168.0.68:icmp_seq=1FragneededandDFset(mtu=1490)From192.168.0.68:icmp_seq=1FragneededandDFset(mtu=1490)From192.168.0.68:icmp_seq=1FragneededandDFset(mtu=1490)From192.168.0.68:icmp_seq=1FragneededandDFset(mtu=1490)From192.168.0.68:icmp_seq=1FragneededandDFset(mtu=1490)

Nãoseiondemaisprocurar.TenhocertezadequeessafragmentaçãodeMTUéaorigemdoerro.

ComopossomelivrardesseerrodeDNSverisign?

masterconfig:

acl"trusted" {
        108.61.190.64;
        107.191.60.48;
        2001:19f0:7000:8945::64;
        2001:19f0:6c00:8141::64;
        108.61.10.10;
        127.0.0.1/32;
        ::1/128;
};

acl "outside" {
        any;
};

options {
        directory "/usr/local/etc/namedb/working/";
        pid-file "/var/run/named/named.pid";
        dnssec-enable yes;
        dnssec-validation auto;
        dnssec-lookaside auto;
        listen-on-v6 { ::1; 2001:19f0:6c00:8141::64;};
        listen-on { 127.0.0.1; 108.61.190.64;};
        max-cache-ttl 1600;
        version none;
        auth-nxdomain no;    # conform to RFC1035
        allow-recursion-on { any; };
        allow-recursion{ any; };
        allow-query-cache-on{ any; };
        allow-query-on{ any; };
        allow-update-forwarding{ any; };
        allow-query {
                any;
        };

        allow-query-cache {
                any;
        };

        allow-transfer {
                any;
        };
        //forward first;
        forwarders {
                108.61.10.10;
                108.61.190.64;
                107.191.60.48;
        };
};


logging {
        category default { default_log; };
        category queries { resolver_file; };
        channel default_log {
                file "/var/log/named/named.log" versions 5 size 50M;
                print-time yes;
                print-severity yes;
                print-category yes;
                severity debug;
        };
        channel resolver_file {
                file "/var/log/named/resolver.log" versions 3 size 5m;
                severity dynamic;
                print-time yes;
        };
        channel xfer-in_file {
                file "/var/log/named/xfer-in.log" versions 3 size 5m;
                severity dynamic;
                print-time yes;
        };
        category default { default_log; };
        category general { default_log; };
};


#include "/usr/local/etc/namedb/rndc.key";

controls {
        inet * port 953 allow { 127.0.0.1/32; ::1/128; 107.191.60.48; 108.61.190.64;} keys {"rndc-key"; };
};
key "rndc-key" {
        algorithm hmac-md5;
        secret "KcnxhOeXddg8dRNrn9Qfew==";
};


view "external" {
        match-clients { any; };
        match-destinations { any; };
        recursion yes;
        allow-query { any; };
        zone "." IN {
                type hint;
                file "/usr/local/etc/namedb/named.root";
        };
        zone "ex-mailer.com" {
                type master;
                allow-transfer { trusted; };
                also-notify { 108.61.190.64; };
                update-policy local;
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/ex-mailer.com.external.signed";
        };
        zone "nyctelecomm.com" {
                type master;
                #allow-transfer {107.191.60.48;};
                also-notify {107.191.60.48;};
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/nyctelecomm.com.external.signed";
        };
        zone "emailingu.com" {
                type master;
                update-policy local;
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/emailingu.com.external.signed";
        };
        zone "instaknowit.com" {
                type master;
                update-policy local;
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/instaknowit.com.external";
        };

        zone "zippy-mail.com" {
                type master;
                update-policy local;
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/zippy-mail.com.external.signed";
        };

        zone "190.61.108.in-addr.arpa"{
                type master;
                file "/usr/local/etc/namedb/reverse.external";
        };
        zone "127.in-addr.arpa" {
                type master;
                file "/usr/local/etc/namedb/127.0.0.1";
        };

};

configuração do escravo: 

acl "trusted" {
        108.61.190.64;
        107.191.60.48;
        2001:19f0:7000:8945::64;
        2001:19f0:6c00:8141::64;
        108.61.10.10;
        127.0.0.1/32;
        ::1/128;
};

acl "outside" {
        any;
};

options {
        directory "/usr/local/etc/namedb/working/";
        pid-file "/var/run/named/named.pid";
        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;
        auth-nxdomain no;
        listen-on-v6 { ::1; 2001:19f0:7000:8945::64;};
        listen-on { 127.0.0.1; 107.191.60.48;};
        max-cache-ttl 1600;
        version none;
        notify yes;
        also-notify { 108.61.190.64; };
        allow-notify { 107.191.60.48; };
        allow-recursion { any; };
        allow-recursion-on { any; };
        allow-query-cache-on{ any; };
        allow-query-on{ any; };
        allow-update-forwarding{ any; };
        allow-transfer { any; };
        allow-query {
                any;
        };
        allow-query-cache {
                any;
        };

        allow-update {
                trusted;
        };

        //forward first;
        forwarders {
                108.61.10.10;
                108.61.190.64;
                107.191.60.48;
        };
};


logging {
        category default { default_log; };
        category queries { resolver_file; };
        channel default_log {
                file "/var/log/named/named.log" versions 5 size 50M;
                print-time yes;
                print-severity yes;
                print-category yes;
                severity debug;
        };
        channel general_file {
                file "/var/log/named/general.log" versions 3 size 5m;
                severity dynamic;
                print-time yes;
        };
        channel config_file {
                file "/var/log/named/config.log" versions 3 size 5m;
                severity dynamic;
                print-time yes;
        };
        channel resolver_file {
                file "/var/log/named/resolver.log" versions 3 size 5m;
                severity dynamic;
                print-time yes;
        };
        channel xfer-in_file {
                file "/var/log/named/xfer-in.log" versions 3 size 5m;
                severity dynamic;
                print-time yes;
        };
        category default { default_log; };
        category general { default_log; };
};


#include "/usr/local/etc/namedb/rndc.key";

controls {
        inet * port 953 allow { 127.0.0.1/32; ::1/128; 108.61.190.64; 107.191.60.48; } keys {"rndc-key"; };
};

key "rndc-key" {
        algorithm hmac-md5;
        secret "N/SB9HZwr5yRIBwtRjcA6A==";
};

view "external" {
        match-clients { outside; };
        match-destinations { outside; };
        recursion yes;
        allow-recursion { any; };
        allow-query { outside; };
        zone "." IN {
                type hint;
                file "/usr/local/etc/namedb/named.root";
        };

        #include "/usr/local/etc/namedb/tmp/zonelist.db";

        zone "nyctelecomm.com" {
                type slave;
                masters {108.61.190.64;};
                allow-notify { trusted; };
                allow-transfer { any; };
                notify yes;
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/nyctelecomm.com.external.signed";
        };
        zone "ex-mailer.com" {
                type slave;
                masters {108.61.190.64; };
                #transfer-source { 108.61.190.64; };
                allow-notify{ trusted; };
                notify yes;
                allow-transfer { any; };
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/ex-mailer.com.external.signed";
        };

        zone "emailingu.com" {
                masters {108.61.190.64; };
                type slave;
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/emailingu.com.external.signed";
        };
        zone "zippy-mail.com" {
                type slave;
                masters {108.61.190.64; };
                auto-dnssec allow;
                key-directory "/usr/local/etc/namedb/";
                file "/usr/local/etc/namedb/zippy-mail.com.external.signed";
        };

        zone "190.61.108.in-addr.arpa"{
                type master;
                allow-update {none;};
                file "/usr/local/etc/namedb/reverse.external";
        };
        zone "127.in-addr.arpa" {
                type master;
                allow-update {none;};
                file "/usr/local/etc/namedb/127.0.0.1";
        };

};
    
por mine 07.03.2015 / 13:38

1 resposta

1

Obrigado por postar todas essas informações, isso ajudou muito.

A ferramenta Verisign deu erro: 

Query to yoda.ex-mailer.com/108.61.175.48 for ex-mailer.com/A timed out or failed

O domínio em que você está interessado está publicando dois registros NS diferentes. 

ex-mailer.com   nameserver = yoda.ex-mailer.com.
ex-mailer.com   nameserver = r2d2.ex-mailer.com.

De minha própria rede, posso conectar-me ao r2d2 e consultar o IP do yoda. Quando tento me conectar ao yoda, não recebo nada. É isso que a Verisign está apontando. Quando eu olho um pouco mais, vejo que minhas tentativas de conexão ao yoda estão recebendo ICMP Destination Unreachable pacotes do yoda em 108.61.175.20.

Curiosamente, o r2d2 está mostrando o endereço IP do Yoda como 108.61.175.48 , mas o seu arquivo de configuração sugere que ele deve ser 108.61.190.64 ou 108.61.10.10 . Desses dois o primeiro responde com sucesso.

Parece uma das duas coisas.

  1. O registro de 'yoda' está desativado. Deve ser 108.61.190.64 , não 108.61.175.48
  2. O registro NS deve estar apontando para o registro A de qualquer 108.61.190.64 .
por 07.03.2015 / 14:07

Tags

Novo controlador de domínio para combinar dois domínios em um: replicação de domínio ou DNS? Perda de conexão com a Internet após adicionar o segundo endereço IP (Windows)