failure: forwarding + signatures + CNAME to sibling
Maybe there are some additional conditions needed to trigger the problem.
Example log:
[44705.16][resl] => id: '14071' querying: '193.17.47.1#00053' score: 21 zone cut: 'dns-oarc.net.' qname: 'Rate.dnS-OaRc.NET.' qtype: 'A' proto: 'udp' [44705.16][iter] <= answer received: ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 14071 ;; Flags: qr rd ra cd QUERY: 1; ANSWER: 4; AUTHORITY: 0; ADDITIONAL: 1;; EDNS PSEUDOSECTION: ;; Version: 0; flags: do; UDP size: 4096 B; ext-rcode: Unused
;; QUESTION SECTION rate.dns-oarc.net. A
;; ANSWER SECTION rate.dns-oarc.net. 120 CNAME dev.dns-oarc.net. rate.dns-oarc.net. 120 RRSIG CNAME 8 3 120 20201028101102 20200928091102 12093 dns-oarc.net. Rttx3oznjSpRgoKZPNi1vYY3fP8KDq+y82p9cs+upwXHdpx/sB8pS4LvHlME53fJ5wqf8vmcAY07kJU4z4PKFam6Qj0a7De2zX3+JEFhZhUGV4UGxgbgX1lZTfS/bRPBmO/vxwCproIiIgWxgZLOvJb4kyCtscD8QWWxn2Tijvk= dev.dns-oarc.net. 300 A 77.72.225.245 dev.dns-oarc.net. 300 RRSIG A 8 3 300 20201026021701 20200928021701 25608 dev.dns-oarc.net. faVj+wxFlFAjg2PQm9Dj4zjA2Ad57cXKv62YFVZ1x0zAUaBXnN+95YEfHwuBanu9P7REBKyaL47NmRo9BPOIzwxTbD610lUEWjx9OkMzmZwJOr5EddraB523q2BLToqJX344NBPNywtMUuYKPQQlBKzFN+Av/gstXGUCfyccU2E=
;; ADDITIONAL SECTION
[44705.16][iter] <= rcode: NOERROR [44705.16][vldr] >< bogus signatures: dev.dns-oarc.net. A (3 matching RRSIGs, 0 expired, 0 not yet valid, 3 invalid signer, 0 invalid label count, 0 invalid key, 0 invalid crypto, 0 invalid NSEC) [44705.16][vldr] >< cut changed (new signer), needs revalidation [44705.16][resl] <= server: '185.43.135.1' rtt: 135 ms [44705.16][plan] plan 'rate.dns-oarc.net.' type 'DS' uid [44705.17] [44705.17][iter] 'rate.dns-oarc.net.' type 'DS' new uid was assigned .18, parent uid .16 [44705.18][cach] => skipping exact packet: rank 025 (min. 030), new TTL -501 [44705.18][cach] => trying zone: ., NSEC, hash 0 [44705.18][cach] => NSEC sname: range search miss (!covers) [44705.18][cach] => skipping zone: ., NSEC, hash 0;new TTL -123456789, ret -2 [ ][nsre] score 21 for 185.43.135.1#00053; cached RTT: 120 [ ][nsre] score 21 for 193.17.47.1#00053; cached RTT: 11 [44705.18][resl] => id: '45855' querying: '185.43.135.1#00053' score: 21 zone cut: 'dev.dns-oarc.net.' qname: 'rAtE.dNs-oArC.nET.' qtype: 'DS' proto: 'udp' [44705.18][resl] => id: '45855' querying: '193.17.47.1#00053' score: 21 zone cut: 'dev.dns-oarc.net.' qname: 'rAtE.dNs-oArC.nET.' qtype: 'DS' proto: 'udp' [44705.18][iter] <= answer received: ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 45855 ;; Flags: qr rd ra cd QUERY: 1; ANSWER: 4; AUTHORITY: 0; ADDITIONAL: 1
;; EDNS PSEUDOSECTION: ;; Version: 0; flags: do; UDP size: 4096 B; ext-rcode: Unused
;; QUESTION SECTION rate.dns-oarc.net. DS
;; ANSWER SECTION rate.dns-oarc.net. 120 CNAME dev.dns-oarc.net. rate.dns-oarc.net. 120 RRSIG CNAME 8 3 120 20201028101102 20200928091102 12093 dns-oarc.net. Rttx3oznjSpRgoKZPNi1vYY3fP8KDq+y82p9cs+upwXHdpx/sB8pS4LvHlME53fJ5wqf8vmcAY07kJU4z4PKFam6Qj0a7De2zX3+JEFhZhUGV4UGxgbgX1lZTfS/bRPBmO/vxwCproIiIgWxgZLOvJb4kyCtscD8QWWxn2Tijvk= dev.dns-oarc.net. 300 DS 65191 8 2 7202E542EC7177402116BE5EABB2366EAA1EEE8196A03934B2870A11DF174102 dev.dns-oarc.net. 300 RRSIG DS 8 3 300 20201028101102 20200928091102 12093 dns-oarc.net. jwebuweys5NQ5g/QYmltaYRxs7s1pvWXtvS/yH3JounDaBklEseOvfumUv9VdxbxT7a/U/rwWDg3CNtXlOO+4W8WpQp94Tz0wSAwT/UcA5hh38hPXnqJ/nH3gvRmEUi8iEMwl2c615IZ9YX4zNXh07oNfPeWTgzjKu6nHNF8bKA=
;; ADDITIONAL SECTION
[44705.18][iter] <= rcode: NOERROR [44705.18][vldr] <= no useful RR in authoritative answer [44705.18][cach] => stashed packet: rank 025, TTL 120, DS rate.dns-oarc.net. (472 B) [44705.00][resl] request failed, answering with empty SERVFAIL [44705.18][resl] finished: 8, queries: 5, mempool: 49200 B