Pb DNS bind9

Err - address not available resolving

18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:503:c27::2:30#53
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:7fd::1#53
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:500:200::b#53
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:500:12::d0d#53

Solution

Pb IPv6. Il faut lancer le daemon avec l'option -4

Err - resolver priming query complete: timed out

10-Jun-2026 17:02:54.990 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete) 17:04:24 [18/1937]10-Jun-2026 17:02:54.990 managed-keys-zone: Key 38696 for zone . is now trusted (acceptance timer complete)
10-Jun-2026 17:03:04.986 resolver priming query complete: timed out
10-Jun-2026 17:03:11.222 chase DS servers resolving 'platform.aws.gts/DS/IN': 192.168.10.1#53
10-Jun-2026 17:03:11.234 chase DS servers resolving 'platform.aws.gts/DS/IN': 192.168.10.2#53
10-Jun-2026 17:03:21.192 resolver priming query complete: timed out
10-Jun-2026 17:03:21.219 broken trust chain resolving 'z1.acme.local/A/IN': 192.168.10.1#53

Solution : Ajouter dnssec-validation no;

named.conf

options { forwarders { 8.8.8.8; 8.8.4.4; }; dnssec-validation no; allow-recursion { trusted; }; allow-query { trusted; }; };

DNSSEC resolution on BIND in 'forwarder' mode fails with SERVFAIL or 'broken trust chain' errors

Source : https://access.redhat.com/solutions/5633621

BIND server fails with resolution of DNSSEC addresses.

The logs contain following errors:

broken trust chain resolving 'DDD.CCC.BBB.AAA.in-addr.arpa/PTR/IN'
client ... (DDD.CCC.BBB.AAA.in-addr.arpa): view internal: query failed (SERVFAIL) for DDD.CCC.BBB.AAA.in-addr.arpa/IN/PTR at ../../../bin/named/query.c:8580

Deactivation of DNSSEC resolution restores main DNS functionality:

dnssec-enable no;
dnssec-validation no;

Note : Il suffit parfois de dnssec-validation no;

Autres

options { minimal-responses yes; edns-udp-size 512; dnssec-validation auto; };