Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:pb_dns_bind9 [2026/06/11 10:07] – Jean-Baptiste
+++ tech:pb_dns_bind9 [2026/06/11 20:25] (Version actuelle) – Jean-Baptiste
@@ Ligne 39: / Ligne 39: @@
 options {
     forwarders {
 .8.8.8;
 .8.4.4;
     };
     dnssec-validation no;
@@ Ligne 47: / Ligne 47: @@
 };
 ~~~
+## DNSSEC resolution on BIND in 'forwarder' mode fails with SERVFAIL or 'broken trust chain' errors
+Source : https://access.redhat.com/solutions/5633621
+BIND server fails with resolution of DNSSEC addresses.
+The logs contain following errors:
+~~~
+broken trust chain resolving 'DDD.CCC.BBB.AAA.in-addr.arpa/PTR/IN'
+client ... (DDD.CCC.BBB.AAA.in-addr.arpa): view internal: query failed (SERVFAIL) for DDD.CCC.BBB.AAA.in-addr.arpa/IN/PTR at ../../../bin/named/query.c:8580
+~~~
+Deactivation of DNSSEC resolution restores main DNS functionality:
+~~~
+dnssec-enable no;
+dnssec-validation no;
+~~~
+Note : Il suffit parfois de `dnssec-validation no;`