<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>This is clipped from the post on <a href="https://lists.isc.org/pipermail/bind-users/2010-October/081577.html">https://lists.isc.org/pipermail/bind-users/2010-October/081577.html</a></div><div><br></div><div>"<span class="Apple-style-span" style="font-family: monospace; white-space: pre; ">When I recently installed the root dnssec initial key on our DNS it broke </span></div><pre>it's ability to accept responses for forwarded requests for a DNS block
list zone served by another system. Other queries aren't affected. The
config for the forwarded zone looks like:
zone "dnsbl" {
type forward;
forward only;
forwarders {
10.0.0.124;
};
};
The server at 10.0.0.124 is running rbldnsd. Queries to our main resolver
DNS for anything in the 'dnsbl' zone generate a SERVFAIL and BIND logs
messages similar to the following:
error (chase DS servers) resolving 'sbl.dnsbl/DS/IN': 10.0.0.124#53
If I disable the root initial key, the forwarded queries work again. I
think the problem is that our pseudo TLD 'dnsbl' isn't a signed zone or
something like that. The RRs for the zone are retrieved from various spam
BL repositories.
Is there a way to disable dnssec validation on a per-zone basis for
internal pseudo TLDs?
Antonio Querubin
808-545-5282 x3003
e-mail/xmpp: <a href="https://lists.isc.org/mailman/listinfo/bind-users">tony at lava.net</a>"
</pre><pre><br></pre><pre>We are facing the same problem on our test environment at the moment. Our server is running local BIND and rblnsd </pre><pre>on localhost port XX. Anyone else having this issue?</pre><pre><br></pre><pre>Br</pre><pre><br></pre><pre>Mikko Lahteenmaki</pre><pre>Finland</pre><pre><br></pre><pre><br></pre><pre><br></pre></body></html>