IT Toolbox
Guide

How to diagnose DNSSEC and SERVFAIL

This BAOI guide provides a structured method for diagnosing dnssec and a serfail without multiplying unnecessary changes.

TopicStorage / NAS / SAN →
⌚ About 2 min read
View my favorites
& DNS Network Intermediate. 15-30 min

This BAOI guide provides a structured method for diagnosing dnssec and a serfail without multiplying unnecessary changes.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Set perimeter

    Identify the equipment, service, affected users and start time.

  2. 2

    Collect Elements

    Record the exact messages, logs and useful settings.

  3. 3

    Test methodically

    Start with the basic dependencies before the application components.

  4. 4

    Apply correction

    Change only the identified parameter or component.

  5. 5

    Validate

    Rewrite the full scenario and document the result.

Commands utiles

Resolve-Dns(1) example.com -DnssecOk.

À retenir

  • Keep the initial values for a backwards.
  • Avoid multiple simultaneous changes.
  • Compare with a functional configuration when possible.
← All les guides
Technical deep dive

Advanced DNS: diagnose DNSSEC and AXFR from the authority

Technical checkpoints

  • DNSSEC SERVFAIL often comes from a broken chain of trust: parent DS, DNSKEY, RRSIG, algorithm or signature dates.
  • Comparing a validating query with a +cd query helps distinguish missing data from validation failure.
  • AXFR should be allowed only to intended secondaries; the SOA serial helps verify they receive the correct version.

Targeted dig

Query DNSKEY/DS/RRSIG and the authority itself before changing the zone.

dig +dnssec example.com A
dig example.com DNSKEY
dig @ns1.example.com example.com AXFR

Topic-specific pitfalls

  • Changing DNSSEC keys without synchronizing the parent DS can prolong SERVFAIL.
  • Opening AXFR to the Internet exposes the entire zone and is not an acceptable production test.

How to validate

  • The DS→DNSKEY→RRSIG chain validates and signature dates are correct.
  • Only authorized secondaries can AXFR and their SOA serial converges.

Operational context

A DNSSEC-related SERVFAIL usually means validation could not build a trusted chain or the signed data is inconsistent. Compare validating and non-validating resolution, then inspect DS/DNSKEY/RRSIG timing and delegation.

Step-by-step checks

  1. Confirm the failure is specific to validating resolvers and record the exact name/type that returns SERVFAIL.
  2. Trace delegation from the parent zone and verify the DS record matches the active child DNSKEY.
  3. Check DNSKEY and RRSIG presence, algorithm/key tags, signature inception/expiration and authoritative server consistency.
  4. Account for recent key rollovers, stale secondary zones and resolver cache before changing DNSSEC state.

Useful verification commands

Use commands only on systems you administer and capture the read-only output before making a configuration change.

dig +dnssec example.com A
dig +trace +dnssec example.com A
dig example.com DNSKEY +dnssec

How to validate the result

A validating resolver must return the expected answer with the DNSSEC authenticated-data state, and independent authoritative servers must publish a consistent signed zone.

Evidence to keep

Keep dig output for DS, DNSKEY and the failing record, resolver identity, authoritative server used and the UTC time of validation.

Frequently asked question

Should I disable DNSSEC when I see SERVFAIL?

Not as a first response. SERVFAIL is evidence of a validation or availability problem; trace the broken chain and correct the signing/delegation fault.

Related BAOI resources: IT tools · procedures · IT dictionary.

♡ 0