Getting BOGUS results only from specific domains

mirkbowl · September 21, 2020, 5:00am

Expected Behaviour:

[Loading any site, as long as the timesync is correct and all other things are nominal, should result in a passed DNSSEC test]

Actual Behaviour:

[Nearly every site, with DNSSEC turned on via Settings page, works fine, except for Windows and Roomba. I was told that if it was an issue with my Pi's time being out of sync, then all domains would not resolve. However, everything else is working fine except for when I try to update my Windows machine or try to load the Roomba app. The web interface shows those domains returning a BOGUS DNSSEC check.]

Debug Token:

[https://tricorder.pi-hole.net/ea7jo8l6df]

Coro · September 21, 2020, 4:13pm

So it is likely truly BOGUS = something (maybe malicious) happens on the DNS path for these domains.

Can you provide which domains fail exactly so we can try to reproduce?
Which upstream DNS provider do you use? Do you still see the same BOGUS reports if you try, for instance, Google as upstream?

jfb · September 21, 2020, 4:22pm

BOGUS can also result when a site does not keep their certificate current.

mirkbowl · September 21, 2020, 5:07pm

Sure, the domains I see the BOGUS results are:

ctldl.windowsupdate.com
www.bing.com
accounts.us1.gigya.com

I am using my router (gateway) as my upstream server, as I use eero and have the eero Secure system. I've just tried, setting Google as my upstream server, but still experience the same results.

When I ran these domains through DNSSEC analyzer at https://dnssec-debugger.verisignlabs.com/ I got some results that seems to indicate something was off on their side, but don't have enough knowledge to diagnose myself.

jfb · September 21, 2020, 5:24pm

For comparison purposes only, using a local instance of unbound (which is doing DNSSEC), I receive no errors digging either of these domains.

DanSchaper · September 21, 2020, 5:33pm

Run the command below on the Pi-hole device and compare to my output.

dig +dnssec +trace ctldl.windowsupdate.com @127.0.0.1

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> +dnssec +trace ctldl.windowsupdate.com @127.0.0.1
;; global options: +cmd
.                       518400  IN      NS      a.root-servers.net.
.                       518400  IN      NS      b.root-servers.net.
.                       518400  IN      NS      c.root-servers.net.
.                       518400  IN      NS      d.root-servers.net.
.                       518400  IN      NS      e.root-servers.net.
.                       518400  IN      NS      f.root-servers.net.
.                       518400  IN      NS      g.root-servers.net.
.                       518400  IN      NS      h.root-servers.net.
.                       518400  IN      NS      i.root-servers.net.
.                       518400  IN      NS      j.root-servers.net.
.                       518400  IN      NS      k.root-servers.net.
.                       518400  IN      NS      l.root-servers.net.
.                       518400  IN      NS      m.root-servers.net.
.                       518400  IN      RRSIG   NS 8 0 518400 20201004050000 20200921040000 46594 . WYDI80CC0vGMrYj53m2LnOvWzGNLlC4JzrzkycxgY5KSFH0xpX4BfE/L JeTKc08KUCpar6pUh0RN5dt5A3E8B8CU8VJYurCPsJVWpdjlwJ9b0eJq 57FVIbbNmXrdO2mZYsDjLEOOn4IqE9WaYlCHmb6QTLxJxJw2/wPqTb0j akhaEMkt6HOgPBvwCWXNJy5VzoNXPkoRCD5RnMb/BzbGAk47NbE7ANpA rkEtjJISdIuMu581ARHoe3yio/iCkbJLsKoCQvksJfDsc/lTIIUPAVbi xPiPWryjNuXWfqAHe+V7u/Ml0AwHkirYkOlbL0FE19WT2WP3oDZFiajl envyXg==
;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 31 ms

com.                    172800  IN      NS      m.gtld-servers.net.
com.                    172800  IN      NS      i.gtld-servers.net.
com.                    172800  IN      NS      a.gtld-servers.net.
com.                    172800  IN      NS      k.gtld-servers.net.
com.                    172800  IN      NS      f.gtld-servers.net.
com.                    172800  IN      NS      c.gtld-servers.net.
com.                    172800  IN      NS      g.gtld-servers.net.
com.                    172800  IN      NS      b.gtld-servers.net.
com.                    172800  IN      NS      d.gtld-servers.net.
com.                    172800  IN      NS      e.gtld-servers.net.
com.                    172800  IN      NS      l.gtld-servers.net.
com.                    172800  IN      NS      j.gtld-servers.net.
com.                    172800  IN      NS      h.gtld-servers.net.
com.                    86400   IN      DS      30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com.                    86400   IN      RRSIG   DS 8 1 86400 20201004170000 20200921160000 46594 . S7W95NJ8lN4wDys+jP7DGY+NmKzqlyHy2RjZimwa7r0waj+mRIlkimXC LcQTo66gmIn51u7zXFVaa3XJ2PDDwdYALyNKVKDES2GPHhZFe+XuRxkK 55PRemk7S6Ui9DmaiOUdYTeCu8SGh9J+9PfZb+rUUTljWxL9zxmm6MGv Ri9ult2sVo9vJUZpB5w55L2RAUG6wyIB/k+BeWGoV5//ijIWCovARwHh /Olddxsc6dqynXxFJvFKVu6NQpJIclsD7Zgkr7hs2fVZbQH5nc8nKZs+ eMzd3VqW4X8iE1yVm2WKy1pGGqc8vY5lpNxmrsUfXspOjWG31fxAvkrL kB0qmw==
;; Received 1186 bytes from 193.0.14.129#53(k.root-servers.net) in 73 ms

windowsupdate.com.      172800  IN      NS      ns1-205.azure-dns.com.
windowsupdate.com.      172800  IN      NS      ns2-205.azure-dns.net.
windowsupdate.com.      172800  IN      NS      ns4-205.azure-dns.info.
windowsupdate.com.      172800  IN      NS      ns3-205.azure-dns.org.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200926044119 20200919033119 24966 com. dB6CzrbC8VcbKWR0uYbQM061U9fWYvxpfbcFguY0qz5qsOKbKI7HLPcl Kli4nWlqnQWOc8DERaz/OegCVinCYpRRcFVGpBT2PoHDOIjrX2tV+90I eSW+o0H86xtINvCHvmcEG/YmPZeGQW4f6w4scgs9xOvRjxHJSuk3CCJO iblgZKKBHkeo7T8uEiGrjF7kszQnhs1Xp+xecFcbzXmBMg==
4RSQ3QBM1GJVB90TF72Q3M2I2UU3TVMA.com. 86400 IN NSEC3 1 1 0 - 4RSQ8N1SKP3EQ4NVNMFE4JAUKHCF8N59 NS DS RRSIG
4RSQ3QBM1GJVB90TF72Q3M2I2UU3TVMA.com. 86400 IN RRSIG NSEC3 8 2 86400 20200927044550 20200920033550 24966 com. mXlRVf4oconRoCstthOww0YM4I1h0TiqCEzgUgJoaIyfy/g6LCEudeWV DsDSEG1kcIrQjMO59j1ntrHT4geCg5Nn2SmnP0aw4cpVrbJbeCg1Vao5 nmvJ+KIE0RzFCzw4WFQIu4PLGd7yh5kOLj9XDocCxaK+T5ovlLgjN4Xq /kUKcIhGBu27+9T/+C/x+MNY/iEgRdwBUlO7bvgtfVgatw==
;; Received 783 bytes from 192.12.94.30#53(e.gtld-servers.net) in 85 ms

ctldl.windowsupdate.com. 3600   IN      CNAME   au-bg-shim.trafficmanager.net.
;; Received 95 bytes from 40.90.4.205#53(ns1-205.azure-dns.com) in 47 ms

mirkbowl · September 21, 2020, 5:40pm

This is what I see:

dig +dnssec +trace ctldl.windowsupdate.com @127.0.0.1

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Raspbian <<>> +dnssec +trace ctldl.windowsupdate.com @127.0.0.1
;; global options: +cmd
.                       518400  IN      NS      I.ROOT-SERVERS.NET.
.                       518400  IN      NS      H.ROOT-SERVERS.NET.
.                       518400  IN      NS      C.ROOT-SERVERS.NET.
.                       518400  IN      NS      E.ROOT-SERVERS.NET.
.                       518400  IN      NS      B.ROOT-SERVERS.NET.
.                       518400  IN      NS      L.ROOT-SERVERS.NET.
.                       518400  IN      NS      A.ROOT-SERVERS.NET.
.                       518400  IN      NS      K.ROOT-SERVERS.NET.
.                       518400  IN      NS      J.ROOT-SERVERS.NET.
.                       518400  IN      NS      G.ROOT-SERVERS.NET.
.                       518400  IN      NS      F.ROOT-SERVERS.NET.
.                       518400  IN      NS      D.ROOT-SERVERS.NET.
.                       518400  IN      NS      M.ROOT-SERVERS.NET.
;; Received 267 bytes from 127.0.0.1#53(127.0.0.1) in 2 ms

ctldl.windowsupdate.com. 1237   IN      CNAME   au-bg-shim.trafficmanager.net.
au-bg-shim.trafficmanager.net. 370 IN   CNAME   audownload.windowsupdate.nsatc.net.
audownload.windowsupdate.nsatc.net. 477 IN CNAME wu.azureedge.net.
wu.azureedge.net.       1640    IN      CNAME   wu.ec.azureedge.net.
wu.ec.azureedge.net.    177     IN      CNAME   wu.wpc.apr-52dd2.edgecastdns.net.
wu.wpc.apr-52dd2.edgecastdns.net. 175 IN CNAME  hlb.apr-52dd2-0.edgecastdns.net.
hlb.apr-52dd2-0.edgecastdns.net. 175 IN CNAME   cs11.wpc.v0cdn.net.
cs11.wpc.v0cdn.net.     660     IN      A       72.21.81.240
;; Received 333 bytes from 2001:500:a8::e#53(E.ROOT-SERVERS.NET) in 1 ms

Coro · September 22, 2020, 1:01pm

@mirkbowl The signatures are missing, when you compare to @DanSchaper's output:

DanSchaper:

.                       518400  IN      RRSIG   NS 8 0 518400 20201004050000 20200921040000 46594 . WYDI80CC0vGMrYj53m2LnOvWzGNLlC4JzrzkycxgY5KSFH0xpX4BfE/L JeTKc08KUCpar6pUh0RN5dt5A3E8B8CU8VJYurCPsJVWpdjlwJ9b0eJq 57FVIbbNmXrdO2mZYsDjLEOOn4IqE9WaYlCHmb6QTLxJxJw2/wPqTb0j akhaEMkt6HOgPBvwCWXNJy5VzoNXPkoRCD5RnMb/BzbGAk47NbE7ANpA rkEtjJISdIuMu581ARHoe3yio/iCkbJLsKoCQvksJfDsc/lTIIUPAVbi xPiPWryjNuXWfqAHe+V7u/Ml0AwHkirYkOlbL0FE19WT2WP3oDZFiajl envyXg==

DanSchaper:

com.                    86400   IN      RRSIG   DS 8 1 86400 20201004170000 20200921160000 46594 . S7W95NJ8lN4wDys+jP7DGY+NmKzqlyHy2RjZimwa7r0waj+mRIlkimXC LcQTo66gmIn51u7zXFVaa3XJ2PDDwdYALyNKVKDES2GPHhZFe+XuRxkK 55PRemk7S6Ui9DmaiOUdYTeCu8SGh9J+9PfZb+rUUTljWxL9zxmm6MGv Ri9ult2sVo9vJUZpB5w55L2RAUG6wyIB/k+BeWGoV5//ijIWCovARwHh /Olddxsc6dqynXxFJvFKVu6NQpJIclsD7Zgkr7hs2fVZbQH5nc8nKZs+ eMzd3VqW4X8iE1yVm2WKy1pGGqc8vY5lpNxmrsUfXspOjWG31fxAvkrL kB0qmw==

DanSchaper:

CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200926044119 20200919033119 24966 com. dB6CzrbC8VcbKWR0uYbQM061U9fWYvxpfbcFguY0qz5qsOKbKI7HLPcl Kli4nWlqnQWOc8DERaz/OegCVinCYpRRcFVGpBT2PoHDOIjrX2tV+90I eSW+o0H86xtINvCHvmcEG/YmPZeGQW4f6w4scgs9xOvRjxHJSuk3CCJO iblgZKKBHkeo7T8uEiGrjF7kszQnhs1Xp+xecFcbzXmBMg==
4RSQ3QBM1GJVB90TF72Q3M2I2UU3TVMA.com. 86400 IN NSEC3 1 1 0 - 4RSQ8N1SKP3EQ4NVNMFE4JAUKHCF8N59 NS DS RRSIG

Coro · September 22, 2020, 1:48pm

DanSchaper received data for US, you seem to be in AU?
Maybe this is already a difference.

Can you verify the absence of the RRSIG entries in the dig trace above also when using Google?

Can you also run directly against google?

dig +dnssec +trace ctldl.windowsupdate.com @8.8.8.8

mirkbowl · September 22, 2020, 2:04pm

I am in the US, near Boston. Not sure why it's being flagged as AU?

I don't know how to " verify the absence of the RRSIG entries in the dig trace above also when using Google". Sorry, I am not that familiar with networking lingo or using terminal. Just basic stuff to get by when following tutorials.
Here's the output from the command you told me try:


.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; Received 267 bytes from 8.8.8.8#53(8.8.8.8) in 2 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 199.7.83.42#53(L.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.5.5.241#53(F.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:500:9f::42#53(L.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:dc3::35#53(M.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:503:c27::2:30#53(J.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:503:ba3e::2:30#53(A.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 202.12.27.33#53(M.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:500:2d::d#53(D.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 202.12.27.33#53(M.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 199.7.91.13#53(D.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.36.148.17#53(I.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.5.5.241#53(F.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:7fd::1#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:503:c27::2:30#53(J.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:500:2::c#53(C.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:500:2d::d#53(D.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:dc3::35#53(M.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:dc3::35#53(M.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:7fd::1#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 199.7.83.42#53(L.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.36.148.17#53(I.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 192.36.148.17#53(I.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 905 bytes from 2001:7fd::1#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
dig: too many lookups

Coro · September 22, 2020, 3:04pm

Oh, I just mean the lines

Coro:

DanSchaper:

.                       518400  IN      RRSIG   NS 8 0 518400 20201004050000 20200921040000 46594 . WYDI80CC0vGMrYj53m2LnOvWzGNLlC4JzrzkycxgY5KSFH0xpX4BfE/L JeTKc08KUCpar6pUh0RN5dt5A3E8B8CU8VJYurCPsJVWpdjlwJ9b0eJq 57FVIbbNmXrdO2mZYsDjLEOOn4IqE9WaYlCHmb6QTLxJxJw2/wPqTb0j akhaEMkt6HOgPBvwCWXNJy5VzoNXPkoRCD5RnMb/BzbGAk47NbE7ANpA rkEtjJISdIuMu581ARHoe3yio/iCkbJLsKoCQvksJfDsc/lTIIUPAVbi xPiPWryjNuXWfqAHe+V7u/Ml0AwHkirYkOlbL0FE19WT2WP3oDZFiajl envyXg==

DanSchaper:

com.                    86400   IN      RRSIG   DS 8 1 86400 20201004170000 20200921160000 46594 . S7W95NJ8lN4wDys+jP7DGY+NmKzqlyHy2RjZimwa7r0waj+mRIlkimXC LcQTo66gmIn51u7zXFVaa3XJ2PDDwdYALyNKVKDES2GPHhZFe+XuRxkK 55PRemk7S6Ui9DmaiOUdYTeCu8SGh9J+9PfZb+rUUTljWxL9zxmm6MGv Ri9ult2sVo9vJUZpB5w55L2RAUG6wyIB/k+BeWGoV5//ijIWCovARwHh /Olddxsc6dqynXxFJvFKVu6NQpJIclsD7Zgkr7hs2fVZbQH5nc8nKZs+ eMzd3VqW4X8iE1yVm2WKy1pGGqc8vY5lpNxmrsUfXspOjWG31fxAvkrL kB0qmw==

DanSchaper:

CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200926044119 20200919033119 24966 com. dB6CzrbC8VcbKWR0uYbQM061U9fWYvxpfbcFguY0qz5qsOKbKI7HLPcl Kli4nWlqnQWOc8DERaz/OegCVinCYpRRcFVGpBT2PoHDOIjrX2tV+90I eSW+o0H86xtINvCHvmcEG/YmPZeGQW4f6w4scgs9xOvRjxHJSuk3CCJO iblgZKKBHkeo7T8uEiGrjF7kszQnhs1Xp+xecFcbzXmBMg==
4RSQ3QBM1GJVB90TF72Q3M2I2UU3TVMA.com. 86400 IN NSEC3 1 1 0 - 4RSQ8N1SKP3EQ4NVNMFE4JAUKHCF8N59 NS DS RRSIG

are also not there when Pi-hole is your DNS provider?

The result you posted from Google is very strange, it didn't seem to have worked at all.

How about

dig +dnssec +trace ctldl.windowsupdate.com @1.1.1.1

mirkbowl · September 22, 2020, 4:21pm

I seem to be getting a similar response

dig +dnssec +trace ctldl.windowsupdate.com @1.1.1.1

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Raspbian <<>> +dnssec +trace ctldl.windowsupdate.com @1.1.1.1
;; global options: +cmd
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; Received 267 bytes from 1.1.1.1#53(1.1.1.1) in 1 ms

.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:1::53#53(H.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:9f::42#53(L.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:1::53#53(H.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:dc3::35#53(M.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:12::d0d#53(G.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:9f::42#53(L.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:2d::d#53(D.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:12::d0d#53(G.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 199.9.14.201#53(B.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 202.12.27.33#53(M.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:2f::f#53(F.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:9f::42#53(L.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 198.41.0.4#53(A.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:503:ba3e::2:30#53(A.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:503:c27::2:30#53(J.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:dc3::35#53(M.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:503:ba3e::2:30#53(A.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 199.7.91.13#53(D.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.58.128.30#53(J.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:2f::f#53(F.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:dc3::35#53(M.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 192.58.128.30#53(J.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:500:1::53#53(H.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 2001:7fd::1#53(K.ROOT-SERVERS.NET) in 2 ms

.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
;; Received 353 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 1 ms

.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
;; BAD (HORIZONTAL) REFERRAL
dig: too many lookups

DanSchaper · September 22, 2020, 4:27pm

mirkbowl · September 22, 2020, 4:36pm

So the problem this person mention seems to show a similar result to what my command outputs, but I'm.able to decipher if the answer to the post has a solution that I can implement? Again, a newbie here

DanSchaper · September 22, 2020, 4:39pm

Do you have anything that could be intercepting that traffic. Any kind of firewall on the Pi, on the client or on the router? Do you have a VPN provider or software that affects your network?

mirkbowl · September 23, 2020, 5:15pm

Hey so I do have UFW and Fail2Ban setup, but from what, little, I understand about those, it doesn't seem like those would be causing domain level issues? Please correct me if I'm wrong.

I do have antivirus on my client that I was trying to do Windows updates on (Malwarebytes), but I also see these BOGUS replies from my Xbox One X and other Windows PC that don't have any non-stock antivirus software on them. I know you said firewall, but just thought maybe I'd mention that.

I don't use a VPN on my PC or Xbox. I do have PiVPN setup so that I use my Pi-Hole when my phone/tablet/laptop are not at home, but again, didn't think that this would necessarily affect my PC which is connected via LAN.

The last thing I can mention is that, like I said, my upstream server is my gateway, eero, and they have a feature called "Advance Security". I'm not sure if that would be affecting this. I was told by a developer who works for eero that using eero Plus (a subscription which I use to get Advance Security) supports DNSSEC. Another thing that makes me thing it isn't with eero is, I tried, as one of the first recommendations said, to try and specify a different upstream server and still saw the BOGUS replies.

DanSchaper · September 23, 2020, 5:21pm

Well, BOGUS is the proper response as something/somebody is modifying the records.

I assumed a VPN as there was a comment that you are using Australian servers in the response and that indicates to me that a VPN has moved your traffic.

The issue is that the requests Pi-hole is sending to it's upstream are being intercepted. The problem lies between Pi-hole and the upstream.

Other than that, Pi-hole is functioning as designed and alerting you that there is a validation problem with the DNS queries. That problem exists outside of Pi-hole and thus needs to be resolved by the other products.

DanSchaper · September 23, 2020, 5:26pm

I see that you are using IPv6 and the queries are coming in via that IP. May want to disable IPv6 and see if the problem still exists. There's no reason to use IPv6 between Pi-hole and the eero or any other upstream.

mirkbowl · September 23, 2020, 5:27pm

Okay, I can try disabling ipv6. You mean disabling ipv6 on my RPi, right?
If so, where can I find some newbie friendly instructions on how to do that?

Thanks

system · October 14, 2020, 5:27pm

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.