Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:pb_dns_bind9 [2026/06/10 21:45] – Jean-Baptiste
+++ tech:pb_dns_bind9 [2026/06/11 20:25] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon Pb DNS Bind}}
 # Pb DNS bind9
@@ Ligne 36: / Ligne 39: @@
 options {
     forwarders {
 .8.8.8;
 .8.4.4;
     };
     dnssec-validation no;
     allow-recursion { trusted; };
     allow-query { trusted; };
+};
+~~~
+## DNSSEC resolution on BIND in 'forwarder' mode fails with SERVFAIL or 'broken trust chain' errors
+Source : https://access.redhat.com/solutions/5633621
+BIND server fails with resolution of DNSSEC addresses.
+The logs contain following errors:
+~~~
+broken trust chain resolving 'DDD.CCC.BBB.AAA.in-addr.arpa/PTR/IN'
+client ... (DDD.CCC.BBB.AAA.in-addr.arpa): view internal: query failed (SERVFAIL) for DDD.CCC.BBB.AAA.in-addr.arpa/IN/PTR at ../../../bin/named/query.c:8580
+~~~
+Deactivation of DNSSEC resolution restores main DNS functionality:
+~~~
+dnssec-enable no;
+dnssec-validation no;
+~~~
+Note : Il suffit parfois de `dnssec-validation no;`
+## Autres
+~~~c
+options {
+    minimal-responses yes;
+    edns-udp-size 512;
+    dnssec-validation auto;
 };
 ~~~