我的DNS有一个非常奇怪的问题.我的域名(strugee.net)从某些网络无法解析,并且可以从其他网络解析.
例如,在我的家庭网络上(服务器所在的网络相同)：
% dig strugee.net ; <<>> DiG 9.10.3-P4 <<>> strugee.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY,status: NOERROR,id: 10086 ;; flags: qr rd ra; QUERY: 1,ANSWER: 1,AUTHORITY: 0,ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0,flags:; udp: 4096 ;; QUESTION SECTION: ;strugee.net. IN A ;; ANSWER SECTION: strugee.net. 1800 IN A 216.160.72.225 ;; Query time: 186 msec ;; SERVER: 205.171.3.65#53(205.171.3.65) ;; WHEN: Sat Apr 16 15:42:36 PDT 2016 ;; MSG SIZE rcvd: 56
但是,如果我登录到Digital Ocean上的服务器,域无法解析：
% dig strugee.net ; <<>> DiG 9.9.5-9+deb8u3-Debian <<>> strugee.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY,status: SERVFAIL,id: 58551 ;; flags: qr rd ra; QUERY: 1,ANSWER: 0,flags:; udp: 512 ;; QUESTION SECTION: ;strugee.net. IN A ;; Query time: 110 msec ;; SERVER: 2001:4860:4860::8844#53(2001:4860:4860::8844) ;; WHEN: Sat Apr 16 18:44:25 EDT 2016 ;; MSG SIZE rcvd: 40
但是,直接转到权威的名称服务器工作正常：
% dig @dns1.registrar-servers.com strugee.net ; <<>> DiG 9.9.5-9+deb8u3-Debian <<>> @dns1.registrar-servers.com strugee.net ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY,id: 30856 ;; flags: qr aa rd; QUERY: 1,AUTHORITY: 5,ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0,flags:; udp: 4096 ;; QUESTION SECTION: ;strugee.net. IN A ;; ANSWER SECTION: strugee.net. 1800 IN A 216.160.72.225 ;; AUTHORITY SECTION: strugee.net. 1800 IN NS dns3.registrar-servers.com. strugee.net. 1800 IN NS dns4.registrar-servers.com. strugee.net. 1800 IN NS dns2.registrar-servers.com. strugee.net. 1800 IN NS dns1.registrar-servers.com. strugee.net. 1800 IN NS dns5.registrar-servers.com. ;; Query time: 3 msec ;; SERVER: 216.87.155.33#53(216.87.155.33) ;; WHEN: Sat Apr 16 18:46:36 EDT 2016 ;; MSG SIZE rcvd: 172
很明显,某个大型网络存在问题,无法解析我的域名,但我似乎无法弄清楚在哪里.我浏览了挖掘手册页,了解可能有用的选项,但没有找到任何特别有用的东西.
我在Namecheap上作为域名注册商和DNS托管.我打开了DNSSEC选项.我最近没有对DNS设置进行任何更改.
如何调试此问题并找到有问题的名称服务器？
解决方法
How can I debug this problem and find the offending nameserver?
daxd5提供了一些很好的启动建议,但这里唯一真正的答案是你需要知道如何像递归DNS服务器一样思考.由于权威层有许多错误配置可能导致SERVFAIL不一致,因此您需要DNS专业人员或在线验证工具.
无论如何,我们的目标不是帮助你,但我想确保你明白这个问题没有确凿的答案.
在您的特定情况下,我注意到strugee.net似乎是使用DNSSEC签名的区域.从推荐链中存在DS和RRSIG记录可以看出这一点：
# dig +trace +additional strugee.net <snip> strugee.net. 172800 IN NS dns2.registrar-servers.com. strugee.net. 172800 IN NS dns1.registrar-servers.com. strugee.net. 172800 IN NS dns3.registrar-servers.com. strugee.net. 172800 IN NS dns4.registrar-servers.com. strugee.net. 172800 IN NS dns5.registrar-servers.com. strugee.net. 86400 IN DS 16517 8 1 B08CDBF73B89CCEB2FD3280087D880F062A454C2 strugee.net. 86400 IN RRSIG DS 8 2 86400 20160423051619 20160416040619 50762 net. w76PbsjxgmKAIzJmklqKN2rofq1e+TfzorN+LBQVO4+1Qs9Gadu1OrPf XXgt/AmelameSMkEOQTVqzriGSB21azTjY/lLXBa553C7fSgNNaEXVaZ xyQ1W/K5OALXzkDLmjcljyEt4GLfcA+M3VsQyuWI4tJOng184rGuVvJO RuI= dns2.registrar-servers.com. 172800 IN A 216.87.152.33 dns1.registrar-servers.com. 172800 IN A 216.87.155.33 dns3.registrar-servers.com. 172800 IN A 216.87.155.33 dns4.registrar-servers.com. 172800 IN A 216.87.152.33 dns5.registrar-servers.com. 172800 IN A 216.87.155.33 ;; Received 435 bytes from 192.41.162.30#53(l.gtld-servers.net) in 30 ms
在我们继续之前,我们需要检查签名是否有效. DNSViz是一个经常用于此目的的工具,它确认了there are indeed problems.图中愤怒的红色暗示你有问题,但是我们可以在左侧边栏上展开注意事项,而不是将鼠标放在鼠标上.
RRSIG strugee.net/A alg 8,id 10636: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. RRSIG strugee.net/DNSKEY alg 8,id 16517: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. RRSIG strugee.net/DNSKEY alg 8,id 16517: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. RRSIG strugee.net/MX alg 8,id 10636: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. RRSIG strugee.net/NS alg 8,id 10636: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. RRSIG strugee.net/SOA alg 8,id 10636: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. RRSIG strugee.net/TXT alg 8,id 10636: The Signature Expiration field of the RRSIG RR (2016-04-14 00:00:00+00:00) is 2 days in the past. net to strugee.net: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset,resulting in no secure entry point (SEP) into the zone. (216.87.152.33,216.87.155.33,UDP_0_EDNS0_32768_4096)
问题很明显：您所在区域的签名已过期,并且需要刷新密钥.您看到不一致结果的原因是因为并非所有递归服务器都启用了DNSSEC验证.验证正在放弃您的域名,而对于那些没有验证的域名正在照常运营.
编辑：Comcast的DNS基础设施已知可以实现DNSSEC验证,作为他们的客户之一,我可以确认我也看到了SERVFAIL.
$dig @75.75.75.75 strugee.net | grep status ;; ->>HEADER<<- opcode: QUERY,id: 2011
