Raspbian.raspberrypi.org failing DNSSEC

Help Community Help
1

The issue I am facing:
The url raspbian.raspberrypi.org is showing as "BOGUS" which I gather is a failure of DNSSEC. I've noticed a few other URLs do the same over the last few weeks but have not payed attention to them. Turning of the DNSSEC option in pihole of course resolves this. Running the DNSSEC link on the DNS configuration tab of PIHOLE is successful. Using DNSSEC Analyzer - raspbian.raspberrypi.org it "seems" like the results are fine. Direct NSLookup to router is successful, but I'm assuming it doesnt use DNSSEC.

Details about my system:

2 PI Holes in a failover cluster (VIP) point to the router (Ubiquiti Unifi Dream Machine Pro) that in turn points to 8.8.8.8 and 8.8.4.4. Cable modem is in bridge mode.

What I have changed since installing Pi-hole:
No recent changes to PiHOLE, updates are frequent on the router.

2

Minor correction - this is a domain, not a URL.

BOGUS means "I've found a signed record and the signature is bad."

Check that the time on the Pi is correct for your local time zone, and you can also try a different upstream DNS server to see if the response from a different server is the same.

Here is what I get in a query for this domain with unbound as a local DNS resolver:

dig raspbian.raspberrypi.org

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> raspbian.raspberrypi.org

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42083
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;raspbian.raspberrypi.org. IN A

;; ANSWER SECTION:
raspbian.raspberrypi.org. 3599 IN CNAME mirrordirector.raspbian.org.
mirrordirector.raspbian.org. 3600 IN A 93.93.128.193
;; Query time: 576 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 12 11:44:05 CST 2021
;; MSG SIZE rcvd: 107
4

I'm not following you here. This is the complete log from an online instance of unbound dig for this domain. Where would different nameservers be involved?

Query results for A raspbian.raspberrypi.org

Response:
;; opcode: QUERY, status: NOERROR, id: 55300
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;raspbian.raspberrypi.org.	IN	 A

;; ANSWER SECTION:
raspbian.raspberrypi.org.	0	IN	CNAME	mirrordirector.raspbian.org.
mirrordirector.raspbian.org.	0	IN	A	93.93.128.193

----- Unbound logs -----
Jan 12 18:01:29 unbound[635963:0] notice: init module 0: validator
Jan 12 18:01:29 unbound[635963:0] notice: init module 1: iterator
Jan 12 18:01:29 unbound[635963:0] info: start of service (unbound 1.12.0).
Jan 12 18:01:30 unbound[635963:0] info: 127.0.0.1 raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: resolving raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: priming . IN NS
Jan 12 18:01:30 unbound[635963:0] info: response for . NS IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 2001:500:200::b#53
Jan 12 18:01:30 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:30 unbound[635963:0] info: priming successful for . NS IN
Jan 12 18:01:30 unbound[635963:0] info: response for raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 2001:503:c27::2:30#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <org.> 2001:500:e::1#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: resolving tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving april.ns.cloudflare.com. A IN
Jan 12 18:01:30 unbound[635963:0] info: resolving april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving tony.ns.cloudflare.com. A IN
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 2001:500:a8::e#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 2001:503:c27::2:30#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <com.> 192.33.14.30#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:7e2#53
Jan 12 18:01:30 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.5.6#53
Jan 12 18:01:30 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:30 unbound[635963:0] info: response for raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <raspberrypi.org.> 172.64.32.66#53
Jan 12 18:01:30 unbound[635963:0] info: query response was CNAME
Jan 12 18:01:30 unbound[635963:0] info: resolving raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: response for raspbian.raspberrypi.org. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <org.> 199.19.53.1#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: resolving a.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving b.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving b.ns.bytemark.co.uk. A IN
Jan 12 18:01:30 unbound[635963:0] info: resolving c.ns.bytemark.co.uk. A IN
Jan 12 18:01:30 unbound[635963:0] info: resolving c.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving a.ns.bytemark.co.uk. A IN
Jan 12 18:01:30 unbound[635963:0] info: response for c.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 199.7.91.13#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: resolving nsc.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving nsb.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: resolving nsd.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: response for b.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 199.7.91.13#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <com.> 2001:503:d414::30#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for c.ns.bytemark.co.uk. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 2001:500:2d::d#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:837#53
Jan 12 18:01:30 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:837#53
Jan 12 18:01:30 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:30 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <uk.> 156.154.102.3#53
Jan 12 18:01:30 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:30 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.9.55#53
Jan 12 18:01:30 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:30 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:30 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:30 unbound[635963:0] info: response for a.ns.bytemark.co.uk. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 199.9.14.201#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for b.ns.bytemark.co.uk. A IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <.> 192.33.4.12#53
Jan 12 18:01:30 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:30 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:30 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:30 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:30 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:30 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:30 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:30 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:30 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:30 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 192.112.36.4#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: resolving nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 43.230.48.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 2001:500:200::b#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:404::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <com.> 2001:503:39c1::30#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.8.55#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:209#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 193.0.14.129#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <com.> 192.48.79.30#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:121#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.2.9#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:21#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:404::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: resolving nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 2001:41c8:2::5#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: resolving ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2a01:618:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 80.68.80.26#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 43.230.48.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2a01:618:404::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 2001:41c8:2::5#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 80.68.80.27#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: prime trust anchor
Jan 12 18:01:31 unbound[635963:0] info: generate keytag query _ta-4f66. NULL IN
Jan 12 18:01:31 unbound[635963:0] info: resolving . DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: priming . IN NS
Jan 12 18:01:31 unbound[635963:0] info: resolving _ta-4f66. NULL IN
Jan 12 18:01:31 unbound[635963:0] info: priming . IN NS
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:404::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: resolving nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: resolving nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.102.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 85.17.170.78#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 2001:41c8:2::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for a.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 85.17.170.78#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.101.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 80.68.80.26#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for raspbian.raspberrypi.org. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <raspbian.org.> 2001:41c8:2::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: prime trust anchor
Jan 12 18:01:31 unbound[635963:0] info: response for . NS IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 2001:500:12::d0d#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: priming successful for . NS IN
Jan 12 18:01:31 unbound[635963:0] info: priming successful for . NS IN
Jan 12 18:01:31 unbound[635963:0] info: response for _ta-4f66. NULL IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 198.41.0.4#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 80.68.80.27#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for c.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 2001:1af8:4c00:4::78#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 80.68.80.27#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.220.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for . DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 2001:500:200::b#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: validate keys with anchor(DS): sec_status_secure
Jan 12 18:01:31 unbound[635963:0] info: Successfully primed trust anchor . DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: validate keys with anchor(DS): sec_status_secure
Jan 12 18:01:31 unbound[635963:0] info: Successfully primed trust anchor . DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: validated DS uk. DS IN
Jan 12 18:01:31 unbound[635963:0] info: resolving uk. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: resolving nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: resolving nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: resolving org. DS IN
Jan 12 18:01:31 unbound[635963:0] info: resolving nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 43.230.48.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for uk. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: validated DNSKEY uk. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: resolving co.uk. DS IN
Jan 12 18:01:31 unbound[635963:0] info: response for co.uk. DS IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: validated DS co.uk. DS IN
Jan 12 18:01:31 unbound[635963:0] info: resolving co.uk. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for b.ns.bytemark.co.uk. A IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <bytemark.co.uk.> 2001:1af8:4c00:4::78#53
Jan 12 18:01:31 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for org. DS IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 199.7.83.42#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: validated DS org. DS IN
Jan 12 18:01:31 unbound[635963:0] info: resolving org. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: response for co.uk. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 213.248.220.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:31 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:31 unbound[635963:0] info: response for org. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <.> 199.9.14.201#53
Jan 12 18:01:31 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:31 unbound[635963:0] info: response for org. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <org.> 199.19.57.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: validated DNSKEY org. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: resolving raspberrypi.org. DS IN
Jan 12 18:01:31 unbound[635963:0] info: response for raspberrypi.org. DS IN
Jan 12 18:01:31 unbound[635963:0] info: reply from <org.> 199.249.112.1#53
Jan 12 18:01:31 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:31 unbound[635963:0] info: validated DS raspberrypi.org. DS IN
Jan 12 18:01:31 unbound[635963:0] info: resolving raspberrypi.org. DNSKEY IN
Jan 12 18:01:31 unbound[635963:0] info: priming . IN NS
Jan 12 18:01:32 unbound[635963:0] info: response for . NS IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 2001:7fe::53#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: priming successful for . NS IN
Jan 12 18:01:32 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 2a01:618:404::1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for co.uk. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: validated DNSKEY co.uk. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: resolving bytemark.co.uk. DS IN
Jan 12 18:01:32 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 2a01:618:400::1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for bytemark.co.uk. DS IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 192.33.4.12#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: resolving nsd.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: resolving nsc.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 156.154.103.3#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for b.ns.bytemark.co.uk. A IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <bytemark.co.uk.> 85.17.170.78#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for nsb.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 103.49.80.1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 156.154.100.3#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 213.248.220.1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for nsd.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 2401:fd80:400::1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 156.154.101.3#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 2001:502:ad09::3#53
Jan 12 18:01:32 unbound[635963:0] info: query response was DNSSEC LAME
Jan 12 18:01:32 unbound[635963:0] info: response for raspberrypi.org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 193.0.14.129#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for raspberrypi.org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <org.> 2001:500:c::1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: resolving tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: resolving april.ns.cloudflare.com. A IN
Jan 12 18:01:32 unbound[635963:0] info: resolving april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: resolving tony.ns.cloudflare.com. A IN
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 198.41.0.4#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 2001:500:a8::e#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <com.> 2001:501:b1f9::30#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:837#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.9.55#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.3.11#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for raspberrypi.org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <raspberrypi.org.> 2606:4700:58::adf5:3bf0#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: validated DNSKEY raspberrypi.org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: validate(cname): sec_status_secure
Jan 12 18:01:32 unbound[635963:0] info: prime trust anchor
Jan 12 18:01:32 unbound[635963:0] info: generate keytag query _ta-4f66. NULL IN
Jan 12 18:01:32 unbound[635963:0] info: resolving . DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: resolving _ta-4f66. NULL IN
Jan 12 18:01:32 unbound[635963:0] info: response for _ta-4f66. NULL IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 202.12.27.33#53
Jan 12 18:01:32 unbound[635963:0] info: query response was NXDOMAIN ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for nsc.nic.uk. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <uk.> 213.248.216.1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 198.97.190.53#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <com.> 192.12.94.30#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.5.6#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for tony.ns.cloudflare.com. A IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.5.6#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <com.> 192.52.178.30#53
Jan 12 18:01:32 unbound[635963:0] info: query response was REFERRAL
Jan 12 18:01:32 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:606#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 2400:cb00:2049:1::a29f:837#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for . DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <.> 199.9.14.201#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: validate keys with anchor(DS): sec_status_secure
Jan 12 18:01:32 unbound[635963:0] info: Successfully primed trust anchor . DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: validated DS org. DS IN
Jan 12 18:01:32 unbound[635963:0] info: resolving org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: response for april.ns.cloudflare.com. AAAA IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <cloudflare.com.> 162.159.8.55#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: response for org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <org.> 2001:500:b::1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was ANSWER
Jan 12 18:01:32 unbound[635963:0] info: validated DNSKEY org. DNSKEY IN
Jan 12 18:01:32 unbound[635963:0] info: resolving raspbian.org. DS IN
Jan 12 18:01:32 unbound[635963:0] info: response for raspbian.org. DS IN
Jan 12 18:01:32 unbound[635963:0] info: reply from <org.> 2001:500:f::1#53
Jan 12 18:01:32 unbound[635963:0] info: query response was nodata ANSWER
Jan 12 18:01:32 unbound[635963:0] info: NSEC3s for the referral proved no DS.
Jan 12 18:01:32 unbound[635963:0] info: Verified that unsigned response is INSECURE
5

DNSSEC is based on the KSK/ZSK pairs for the domain. Serial numbers really don't matter.

The issue is that domain is a CNAME for a different zone and that zone is not responding with the proper values.

https://dnsviz.net/d/raspbian.raspberrypi.org/dnssec/

Though I don't see the same issue:

dan@raspberrypi:~ $ dig +dnssec raspbian.raspberrypi.org

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Raspbian <<>> +dnssec raspbian.raspberrypi.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11612
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;raspbian.raspberrypi.org.      IN      A

;; ANSWER SECTION:
raspbian.raspberrypi.org. 300   IN      CNAME   mirrordirector.raspbian.org.
raspbian.raspberrypi.org. 300   IN      RRSIG   CNAME 13 3 300 20210113204009 20210111184009 34505 raspberrypi.org. GRxFaGuvHrnKN9UeMWRbqIDtyHJWYFbRuA667NZ4SVL4VQYhuhWlKeje GxaJ2K6uZpHbrLTdxFt3TzJbpUGE6A==
mirrordirector.raspbian.org. 279 IN     A       93.93.128.193

;; Query time: 32 msec
;; SERVER: 192.168.88.2#53(192.168.88.2)
;; WHEN: Tue Jan 12 11:40:09 PST 2021
;; MSG SIZE  rcvd: 218

dan@raspberrypi:~ $ dig +dnssec raspbian.raspberrypi.org @8.8.8.8

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Raspbian <<>> +dnssec raspbian.raspberrypi.org @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11035
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;raspbian.raspberrypi.org.      IN      A

;; ANSWER SECTION:
raspbian.raspberrypi.org. 190   IN      CNAME   mirrordirector.raspbian.org.
raspbian.raspberrypi.org. 190   IN      RRSIG   CNAME 13 3 300 20210113203823 20210111183823 34505 raspberrypi.org. nUTMuCBpe8SweyY46jI7ZrCvalru1ViNTxC7vtTMntXvTfik3IU6z3i9 A+WTzWgpAVyPgqSRxhKOhciMXnrcZg==
mirrordirector.raspbian.org. 363 IN     A       93.93.128.193

;; Query time: 15 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jan 12 11:40:13 PST 2021
;; MSG SIZE  rcvd: 218
6

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.