Discussion:
[Dnsmasq-discuss] dnscrypt -dnssec problems
Johnny Appleseed
2016-05-25 19:24:51 UTC
Permalink
dig +dnssec wikipedia.org
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.3-P1 <<>> +dnssec wikipedia.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33183
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;wikipedia.org. IN A

;; Query time: 391 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed May 25 13:17:10 2016
;; MSG SIZE rcvd: 42

dig +dnssec wikipedia.org

; <<>> DiG 9.8.3-P1 <<>> +dnssec wikipedia.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13239
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1280
;; QUESTION SECTION:
;wikipedia.org. IN A

;; ANSWER SECTION:
wikipedia.org. 3 IN A 91.198.174.192

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed May 25 13:23:38 2016
;; MSG SIZE rcvd: 58


WHY??? WTF
w***@gmail.com
2016-05-25 21:08:02 UTC
Permalink
Post by Johnny Appleseed
dig +dnssec wikipedia.org
;; Truncated, retrying in TCP mode.
; <<>> DiG 9.8.3-P1 <<>> +dnssec wikipedia.org
;; global options: +cmd
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33183
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
; EDNS: version: 0, flags: do; udp: 4096
why is this EDNS udp 4096 but

[...]
Post by Johnny Appleseed
dig +dnssec wikipedia.org
; <<>> DiG 9.8.3-P1 <<>> +dnssec wikipedia.org
;; global options: +cmd
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13239
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
; EDNS: version: 0, flags: do; udp: 1280
this one is only 1280??
--
NOTE: No off-list assistance is given without prior approval.
*Please keep mailing list traffic on the list* unless
private contact is specifically requested and granted.
Lonnie Abelbeck
2016-05-26 00:14:15 UTC
Permalink
Post by w***@gmail.com
Post by Johnny Appleseed
dig +dnssec wikipedia.org
;; Truncated, retrying in TCP mode.
; <<>> DiG 9.8.3-P1 <<>> +dnssec wikipedia.org
;; global options: +cmd
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33183
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
; EDNS: version: 0, flags: do; udp: 4096
why is this EDNS udp 4096 but
[...]
Post by Johnny Appleseed
dig +dnssec wikipedia.org
; <<>> DiG 9.8.3-P1 <<>> +dnssec wikipedia.org
;; global options: +cmd
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13239
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
; EDNS: version: 0, flags: do; udp: 1280
this one is only 1280??
It would seem the "EDNS ... udp: 4096" query is using dnscrypt-proxy but the "EDNS ... udp: 1280" query is not.

Johnny, possibly you need "no-resolv" in your dnsmasq.conf ?

I assume you have something like:
--
server=127.0.0.1#2053
--
pointing to your dnscrypt-proxy instance.

You may also look into using "proxy-dnssec" if you trust your upstream server's DNSSEC since it traveling over a secure dnscrypt-proxy connection.

Lonnie

Loading...