Hello,

On Tue, Apr 21, 2020 at 1:20 PM Tiemen Ruiten <t.ruiten@tech-lab.io> wrote:
On Tue, Apr 21, 2020 at 1:10 PM Tiemen Ruiten <t.ruiten@tech-lab.io> wrote:
Hello,

On Tue, Apr 21, 2020 at 12:46 PM François Cami <fcami@redhat.com> wrote:
Hi,

On Tue, Apr 21, 2020 at 12:19 PM Tiemen Ruiten via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> wrote:
>
> Hello,
>
> Since a few days ago, we're having issues with resolution of this hostname:
>
> download.wisselkoersenvoorjeadministratie.nl
>
> Our FreeIPA DNS servers return SERVFAIL for that particular hostname. What's funny, after I do a (successful) lookup directly at one of the configured forwarders, 1.1.1.1, resolution works, until the TTL expires. Other hostnames work fine. How can I troubleshoot this?

Please have a look at the logs:
https://www.freeipa.org/page/Troubleshooting/DNS#Getting_logs
There should be some entry at the time you reproduce the issue.

No lines related to named in /var/log/messages.  

I set debug logging with 'rndc trace' on the IPA nameserver that's being queried and this shows up in named.run when I query the hostname:

21-Apr-2020 13:07:37.912 fetch: download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:07:37.939 client @0x7fcee8031200 10.100.120.47#36751 (download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL) for download.wisselkoersenvoorjeadministratie.nl/IN/A at ../../../bin/named-pkcs11/query.c:8580

Added debug level 3, here's a failed lookup and a successful one (after lookup @1.1.1.1):

[root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep wisselkoersen
21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): query (cache) 'download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): replace
21-Apr-2020 13:16:21.398 fetch: download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:16:21.421 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL) for download.wisselkoersenvoorjeadministratie.nl/IN/A at ../../../bin/named-pkcs11/query.c:8580
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): error
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): send
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): sendto
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): senddone
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): next
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (download.wisselkoersenvoorjeadministratie.nl): endrequest
21-Apr-2020 13:16:21.422 fetch completed at ../../../lib/dns-pkcs11/resolver.c:3754 for download.wisselkoersenvoorjeadministratie.nl/A in 0.023506: SERVFAIL/success [domain:wisselkoersenvoorjeadministratie.nl,referral:0,restart:2,qrysent:2,timeout:0,lame:0,quota:0,neterr:0,badresp:2,adberr:0,findfail:0,valfail:0]
^C

[root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep wisselkoersen
21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): query (cache) 'download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): replace
21-Apr-2020 13:17:15.389 fetch: download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(download.wisselkoersenvoorjeadministratie.nl/A): looking for relevant NSEC3
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 proves name does not exist: 'download.wisselkoersenvoorjeadministratie.nl'
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 indicates secure range
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): send
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): sendto
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): senddone
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): next
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (download.wisselkoersenvoorjeadministratie.nl): endrequest


 
Does anyone have an idea? There is at least one domain that is showing the same behaviour that I found: www.regenboog-lelystad.nl

--
Tiemen Ruiten
Infrastructure Engineer