While getting my company setup to use FreeIPA and migrate from the old BIND DNS I have
setup a forward zone on our nameservers to point
exmaple.net to my FreeIPA servers.
When I try to do a query from the main DNS resolvers I get the following:client
10.1.0.66#61548: view internal: query:
infra-test-ipa.example.net IN A +E
(10.1.6.8)validating @0x7f686c62c150:
infra-test-ipa.example.net A: no valid signature
found validating @0x7f68640de9a0:
example.net SOA: no valid signature found validating
@0x7f68640dd990:
infra-test-ipa.example.net NSEC: no valid signature founderror (no valid
RRSIG) resolving 'infra-test-ipa.example.net/DS/IN': 10.1.6.141#53 validating
@0x7f686c69c920:
example.net SOA: no valid signature found validating @0x7f686c69a280:
infra-test-ipa.example.net NSEC: no valid signature founderror (no valid RRSIG) resolving
'infra-test-ipa.example.net/DS/IN': 10.1.6.140#53error (no valid DS) resolving
'infra-test-ipa.example.net/A/IN': 10.1.6.141#53validating @0x7f68640c7630:
infra-test-ipa.example.net A: no valid signature foundvalidating @0x7f68640c7630:
infra-test-ipa.example.net A: bad cache hit (
infra-test-ipa.example.net/DS)
I looked up the error and saw that DNSSEC might be the culprit. However I checked the
resolvers and they say that DNSSEC is not turned on at all://dnssec-enable
no;//dnssec-validation no;//dnssec-lookaside auto;
So just for s&g I installed the DNSSEC portion on my FreeIPA master.
Still getting the same results when doing a dig.
Is there something else I should be doing or should have done? Can I uninstall the DNSSEC
from FreeIPA?
Cheers,Andrew