Failed to retrieve security status update for '4.8.3'

[ballou-git]

Hi, I hope I post in the right place.
Since we have updated all our PowerDNS setups and made them work perfect we still find this error.
Failed to retrieve security status update for '4.8.3' on 'auth-4.8.3.security-status.secpoll.powerdns.com.': RCODE was Server Failure
Can someone please tell me where the error is?
I'm told that it is on you part, can this be true?

Best regards
Fredrik

[Habbie]

can you try dig txt auth-4.8.3.security-status.secpoll.powerdns.com. on a machine that has this problem, and show us the full output?

[ballou-git]

Thank you, this is the output and I've removed the IP of our resolver at the end

# dig txt auth-4.8.3.security-status.secpoll.powerdns.com

; <<>> DiG 9.16.23-RH <<>> txt auth-4.8.3.security-status.secpoll.powerdns.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63379
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;auth-4.8.3.security-status.secpoll.powerdns.com. IN TXT

;; ANSWER SECTION:
auth-4.8.3.security-status.secpoll.powerdns.com. 60 IN TXT "1 OK"

;; Query time: 80 msec
;; SERVER: XXX.XXX.XXX.XXX#53(XXX.XXX.XXX.XXX)
;; WHEN: Tue Nov 14 08:16:18 CET 2023
;; MSG SIZE  rcvd: 93

[ballou-git]

No help here? I would really like to get rid of this error.

[rgacogne]

The output doesn't show any problem so it's likely that your resolver is failing to resolve from time to time, but not always, which is something you will have to investigate on your resolver's side.

[ballou-git]

Thank you.
There is no A-record we get no IP.
You can't just use a TXT record without an A-record as what I know.

[rgacogne]

Sorry, what you are saying does not make any sense to me. Our security polling works by requesting a TXT record via a standard DNS query, there is no IP address involved.

[ballou-git]

I really don't see how the resolver can work without an IP?
Can you please guide me?

[rgacogne]

I would suggest reading how DNS resolution works; a good start might be https://en.wikipedia.org/wiki/Domain_Name_System#Address_resolution_mechanism

[ballou-git]

I'm sorry but I really don't think you are serious.
The last post proves it.

[Habbie]

hello @ballou-git, this is not appropriate and not acceptable. We are serious, we are trying to help you, and we are putting in effort. Please adjust your behaviour, or leave.

[omoerbeek]

For people reading this question some information on how the authoritative servers retrieves the secpoll status:

The autoritatieve server uses the value of the resolver setting to send queries to if it needs to resolve names (outside the zones it's authoritative for). If resolver is not set, the system's /etc/resolv.conf is parsed and the nameservers mentioned in it are used. The addresses found are used tho query a resolver to resolve the secpoll name to a TXT record that indicates the status. See also https://docs.powerdns.com/authoritative/security.html#security-polling. If you log at debug level, you can follow the steps.

Additionally: dnsdist only uses the addresses in /etc/resolv.conf and the recursor resolves the name itself.