Below are a few examples of configurations you can use during the workshop. Note that they may not be suitable for production zones.
trusted-keys {
"." 257 3 5 "AwEAAefwq///dxpJmppvNLLH/2RNST0Lcka2WHr6sd3N3nH4gzHg7qFM
267FGNwoX8VEqgLvlszaAHUY5bRrNFF00xsHkWFHfYvm5pufZdfNgGLU
olOHsHU6jCLQR/PIQm3tuX4NHOD9sYfjmUVAsGlqFuwO9zYnt6L1k6/n
04eKWqa4yLspups4MYlxKMs328D3SojZCMAmea+RXZknJKVRZJ83daup
9LBft/hgEZIG/h5VT/ZK1rwJBMe67EOR94uNgNUGjvOP2iowaU9Czoq3
+Na6yAuCibksQvEp2bZjbutC2zTxHAXNIr3AQwLk4BqA9+PfBZWUUEnp
8i0lZfQiVJU=";
};
This trust-anchor is extracted from the KSK from the root:
. IN DNSKEY 257 3 5 AwEAAefwq///dxpJmppvNLLH/2RNST0Lcka2WHr6sd3N3nH4gzHg7qFM
267FGNwoX8VEqgLvlszaAHUY5bRrNFF00xsHkWFHfYvm5pufZdfNgGLU
olOHsHU6jCLQR/PIQm3tuX4NHOD9sYfjmUVAsGlqFuwO9zYnt6L1k6/n
04eKWqa4yLspups4MYlxKMs328D3SojZCMAmea+RXZknJKVRZJ83daup
9LBft/hgEZIG/h5VT/ZK1rwJBMe67EOR94uNgNUGjvOP2iowaU9Czoq3
+Na6yAuCibksQvEp2bZjbutC2zTxHAXNIr3AQwLk4BqA9+PfBZWUUEnp
8i0lZfQiVJU=
#
# Example configuration file.
#
# See unbound.conf(5) man page.
#
# this is a comment.
#Use this to include other text into the file.
#include: "otherfile.conf"
# The server clause sets the main parameters.
server:
# verbosity number, 0 is least verbose. 1 is default.
verbosity: 1
# specify the interfaces to answer queries from by ip-address.
# The default is to listen to localhost (127.0.0.1 and ::1).
# specify 0.0.0.0 and ::0 to bind to all available interfaces.
# specify every interface[@port] on a new 'interface:' labelled line.
# The listen interfaces are not changed on reload, only on restart.
interface: 192.168.47.210
# Enable IPv4, "yes" or "no".
do-ip4: yes
# Enable IPv6, "yes" or "no".
# do-ip6: yes
# Enable UDP, "yes" or "no".
do-udp: yes
# Enable TCP, "yes" or "no".
do-tcp: yes
# control which clients are allowed to make (recursive) queries
# to this server. Specify classless netblocks with /size and action.
# By default everything is refused, except for localhost.
# Choose deny (drop message), refuse (polite error reply),
# allow (recursive ok), allow_snoop (recursive and nonrecursive ok)
# access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
access-control: 192.168.47.0/24 allow
# if given, user privileges are dropped (after binding port),
# and the given username is assumed. Default is user "unbound".
# If you give "" no privileges are dropped.
username: ""
# file to read root hints from.
# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
root-hints: "/usr/local/etc/unbound/root-hints.conf"
# enable to not answer id.server and hostname.bind queries.
hide-identity: no
# enable to not answer version.server and version.bind queries.
hide-version: no
# the identity to report. Leave "" or default to return hostname.
identity: "My_Perl_OS.pm"
# the version to report. Leave "" or default to return package version.
version: "My_DNS.pl"
# if yes, perform key lookups adjacent to normal lookups.
# prefetch-key: no
# module configuration of the server. A string with identifiers
# separated by spaces. "iterator" or "validator iterator"
# module-config: "validator iterator"
# File with DLV trusted keys. Same format as trust-anchor-file.
# There can be only one DLV configured, it is trusted from root down.
# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
# dlv-anchor-file: "dlv.isc.org.key"
# File with trusted keys for validation. Specify more than one file
# with several entries, one file per entry.
# Zone file format, with DS and DNSKEY entries.
# trust-anchor-file: ""
# File with trusted keys, kept uptodate using RFC5011 probes,
# initial file like trust-anchor-file, then it stores metadata.
# Use several entries, one per domain name, to track multiple zones.
# auto-trust-anchor-file: ""
# Trusted key for validation. DS or DNSKEY. specify the RR on a
# single line, surrounded by "". TTL is ignored. class is IN default.
# (These examples are from August 2007 and may not be valid anymore).
# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"
# File with trusted keys for validation. Specify more than one file
# with several entries, one file per entry. Like trust-anchor-file
# but has a different file format. Format is BIND-9 style format,
# the trusted-keys { name flag proto algo "key"; }; clauses are read.
# trusted-keys-file: ""
# Ignore chain of trust. Domain is treated as insecure.
# domain-insecure: "example.com"
# Override the date for validation with a specific fixed date.
# Do not set this unless you are debugging signature inception
# and expiration. "" or "0" turns the feature off.
# val-override-date: ""
# Have the validator log failed validations for your diagnosis.
# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
val-log-level: 2
python:
# Script file to load
# python-script: "/usr/local/etc/unbound/ubmodule-tst.py"
# Remote control config section.
remote-control:
# Enable remote control with unbound-control(8) here.
# set up the keys and certificates with unbound-control-setup.
# control-enable: no
# what interfaces are listened to for remote control.
# give 0.0.0.0 and ::0 to listen to all interfaces.
# control-interface: 127.0.0.1
# control-interface: ::1
# port number for remote control operations.
# control-port: 953
# unbound server key file.
# server-key-file: "/usr/local/etc/unbound/unbound_server.key"
# unbound server certificate file.
# server-cert-file: "/usr/local/etc/unbound/unbound_server.pem"
# unbound-control key file.
# control-key-file: "/usr/local/etc/unbound/unbound_control.key"
# unbound-control certificate file.
# control-cert-file: "/usr/local/etc/unbound/unbound_control.pem"
# Stub zones.
# Create entries like below, to make all queries for 'example.com' and
# 'example.org' go to the given list of nameservers. list zero or more
# nameservers by hostname or by ipaddress. If you set stub-prime to yes,
# the list is treated as priming hints (default is no).
# stub-zone:
# name: "example.com"
# stub-addr: 192.0.2.68
# stub-prime: no
# stub-zone:
# name: "example.org"
# stub-host: ns.example.com.
# Forward zones
# Create entries like below, to make all queries for 'example.com' and
# 'example.org' go to the given list of servers. These servers have to handle
# recursion to other nameservers. List zero or more nameservers by hostname
# or by ipaddress. Use an entry with name "." to forward all queries.
# forward-zone:
# name: "example.com"
# forward-addr: 192.0.2.68
# forward-addr: 192.0.2.73@5355 # forward to port 5355.
# forward-zone:
# name: "example.org"
# forward-host: fwd.example.com
// example configuration for a recursive server
options {
pid-file "named.pid";
dnssec-enable yes;
listen-on { 192.168.47.151;};
query-source address 192.168.47.151 ;
allow-recursion {localnets; localhost; 192.168.47.128/25; 255.255.255.0 ; };
directory "/usr/local/etc/named_bla_work/";
// For a recursive server add:
// dnssec-validation yes;
// recursion yes;
recursion no;
};
/// Beter uses $include and prevent reading this secret.
// There is also a tool to generate this.
// man 8 rndc-confgen
key "rndc-key" {
algorithm hmac-md5;
secret "upDNkmX9suVSLvf32mnbCw==";
};
controls {
inet 192.168.47.157 port 953
allow { 192.168.47.157;} keys { "rndc-key"; };
};
zone "." {
type hint;
file "root.hints";
};
// Only for a authoritative server
zone "bla.work" {
type master;
file "bla.work";
};
logging {
channel syslog_channel {
syslog daemon; // end to syslog's daemon
severity debug 6;
print-severity yes;
print-category yes;
};
channel query_channel {
file "querylog" size 5m ;
print-time yes;
};
channel update_channel {
file "notify+update.log" size 5m;
print-time yes;
severity debug 5;
};
channel notify_channel {
file "notify+update.log" size 5m;
severity debug 6;
print-time yes;
};
channel everything_else {
file "runlog" size 5m;
print-time yes;
severity debug 6;
print-severity yes;
print-category yes;
};
channel dnssec_log { // a DNSSEC log channel
file "dnsseclog" size 20m;
print-time yes; // timestamp the entries
print-category yes; // add category name to entries
print-severity yes; // add severity level to entries
severity debug 6; // print debug message <= 3 t
};
category dnssec { dnssec_log; };
category security { dnssec_log; };
category queries { query_channel; };
category update { update_channel; syslog_channel; };
category notify { notify_channel; syslog_channel; };
category default { everything_else; };
};
; demonstration zone l ; $TTL 100 @ 100 IN SOA ns ( zonemaster ; assuming zonemaster@orignin 2007082200 100 ; These values 200 ; are to unrealistic for 604800 ; production zones 100 ) NS ns ns A 192.168.47.<YOUR NUMBER> demo A 10.0.0.1 ; Add when you sign your zone ; $include K<your keysigning>.key ; $include K<your zonesigning>.key
; Workshop Root Hints ; NEVER USE IN PRODUCTION NETWORKS . 400 IN NS A.root-servers.work. A.root-servers.work. 400 IN A 213.75.47.140
If you store the Workshop Root Hints in a file (e.g. root.hints) and the DNSKEY RR that is used as trust anchor in another (e.g. keyfile.pub) you can use "drill".
drill can be used in two ways: First by tracing using the "-T" flag wich will start at the root and try to follow the chain of trust from there.
$drill -k keyfile.pub -r root.hints -T www.infra.work A
;; Domain: .
;; Signature ok but no chain to a trusted key or ds record
[S] . 100 IN DNSKEY 256 3 5 ;{id = 46728 (zsk), size = 1024b}
. 100 IN DNSKEY 257 3 5 ;{id = 34129 (ksk), size = 2048b}
Checking if signing key is trusted:
New key: . 100 IN DNSKEY 256 3 5 AwEAAbyUyIWQnMn58xwQVTzv+S+cOqJYT7Y8MH6Q3hdhBXjajZGD+3/oKDzR1s47jc763qgJOBXU/62MWfmcrCxbBPNdMysIl+7Bj/uqt6LD+PvA3dG59QmNHPYvTZdOfXlBrOZXAeBJvm/7OL8ugLoIi+1jYsbI+5DxPJ2cmtzEWyxp ;{id = 46728 (zsk), size = 1024b}
Trusted key: . 3600 IN DNSKEY 257 3 5 AwEAAefwq///dxpJmppvNLLH/2RNST0Lcka2WHr6sd3N3nH4gzHg7qFM267FGNwoX8VEqgLvlszaAHUY5bRrNFF00xsHkWFHfYvm5pufZdfNgGLU ;{id = 5259 (ksk), size = 640b}
[S] work. 100 IN DS 41791 5 2 833bbd1c9210dfcb8a6ec03dcbd3dca096cbc5ddcc17d36dd3fb4b2bf0233bd3
work. 100 IN DS 41791 5 1 6d4063c47bef486d5901a3225bb505e0d57b5ae6
;; Domain: work.
;; Signature ok but no chain to a trusted key or ds record
[S] work. 100 IN DNSKEY 257 3 5 ;{id = 41791 (ksk), size = 1024b}
work. 100 IN DNSKEY 256 3 5 ;{id = 19641 (zsk), size = 1024b}
[S] Existence denied: infra.work. DS
;; No ds record for delegation
;; Domain: infra.work.
;; Signature ok but no chain to a trusted key or ds record
[S] infra.work. 100 IN DNSKEY 257 3 5 ;{id = 10177 (ksk), size = 1024b}
infra.work. 100 IN DNSKEY 256 3 5 ;{id = 57798 (zsk), size = 1024b}
[S] Existence denied: www.infra.work. DS
;; No ds record for delegation
;; Domain: www.infra.work.
;; No DNSKEY record found for www.infra.work.
[S] www.infra.work. 100 IN A 192.168.47.10
;;[S] self sig OK; [B] bogus; [T] trusted
The other approach is the chase functionality with the "-S" option
where you start at the leave and try to work your way up in order to
find a link to an existing trust anchor.
$drill -k keyfile.pub -r root.hints -S www.infra.work A
;; Chasing: www.infra.work. A
DNSSEC Trust tree:
www.infra.work. (A)
|---infra.work. (DNSKEY keytag: 57798)
|---infra.work. (DNSKEY keytag: 10177)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
I the example above the root, work, and infra.work were all signed but there was no secure delegation from work to infra.work.
Apr 09 16:29:54 unbound[72207:0] notice: init module 0: validator Apr 09 16:29:54 unbound[72207:0] notice: init module 1: iterator Apr 09 16:29:54 unbound[72207:0] info: start of service (unbound 1.4.4). Apr 09 16:37:51 unbound[72207:0] info: validation failure: signature expired for from 132.163.4.10 Apr 09 21:15:45 unbound[72207:0] info: validation failure : No DNSKEY record for key valid.antd.nist.gov. while building chain of trust Apr 09 21:58:27 unbound[72207:0] info: validation failure : no keys have a DS from 2001:470:1f14:d0f::37 for key unicycle.cz. while building chain of trust Apr 10 00:25:25 unbound[72207:0] info: validation failure : signature expired from 2001:b48:10:8::216 for key skvadronsbacken.se. while building chain of trust Apr 10 01:37:46 unbound[72207:0] info: validation failure : no keys have a DS from 2001:470:1f06:4c7::38 for key unicycle.cz. while building chain of trust Apr 10 01:41:48 unbound[72207:0] info: validation failure : signature expired from 80.177.121.10 for key cloudba.se. while building chain of trust Apr 10 01:41:48 unbound[72207:0] info: validation failure : key for validation cloudba.se. is marked as invalid because of a previous validation failure : signature expired from 80.177.121.10 for key cloudba.se. while building chain of trust Apr 10 03:06:50 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 10 03:06:50 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 10 03:21:16 unbound[72207:0] info: validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 10 03:21:25 unbound[72207:0] info: validation failure : key for validation mymail.in.th. is marked as invalid because of a previous validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 10 03:21:26 unbound[72207:0] info: validation failure : key for validation mymail.in.th. is marked as invalid because of a previous validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 10 05:54:09 unbound[72207:0] info: validation failure : no keys have a DS from 194.228.3.215 for key dzavy.cz. while building chain of trust Apr 10 05:54:09 unbound[72207:0] info: validation failure : key for validation dzavy.cz. is marked as invalid because of a previous validation failure : no keys have a DS from 194.228.3.215 for key dzavy.cz. while building chain of trust Apr 10 06:12:02 unbound[72207:0] info: validation failure : No DNSKEY record for key cicf.virginia.gov. while building chain of trust Apr 10 06:12:02 unbound[72207:0] info: validation failure : key for validation cicf.virginia.gov. is marked as invalid because of a previous validation failure : No DNSKEY record for key cicf.virginia.gov. while building chain of trust Apr 10 06:56:45 unbound[72207:0] info: validation failure : signature expired from 81.19.8.169 for key och.cz. while building chain of trust Apr 10 11:10:32 unbound[72207:0] info: validation failure : signature expired from 83.241.177.38 for key keyserver.se. while building chain of trust Apr 10 11:50:08 unbound[72207:0] info: validation failure : signature expired from 195.39.74.205 for key och.cz. while building chain of trust Apr 10 13:11:47 unbound[72207:0] info: validation failure : signature expired from 217.16.192.26 for key better.se. while building chain of trust Apr 10 13:40:43 unbound[72207:0] info: validation failure : signature expired from 81.19.8.169 for key och.cz. while building chain of trust Apr 10 14:40:10 unbound[72207:0] info: validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 10 14:40:11 unbound[72207:0] info: validation failure : key for validation virginia.dnsops.gov. is marked as invalid because of a previous validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 10 14:57:54 unbound[72207:0] info: validation failure : No DNSKEY record for key hud.gov. while building chain of trust Apr 10 14:57:54 unbound[72207:0] info: validation failure : No DNSKEY record for key hud.gov. while building chain of trust Apr 10 15:32:55 unbound[72207:0] info: validation failure : No DNSKEY record for key epost.bg. while building chain of trust Apr 10 15:46:23 unbound[72207:0] info: validation failure : signature crypto failed from 143.118.2.1 for key ncw.se. while building chain of trust Apr 10 16:22:22 unbound[72207:0] info: validation failure : signature expired from 147.229.252.34 for key bces.cz. while building chain of trust Apr 10 16:40:37 unbound[72207:0] info: validation failure : No DNSKEY record for key workcomp.virginia.gov. while building chain of trust Apr 10 16:40:38 unbound[72207:0] info: validation failure : key for validation workcomp.virginia.gov. is marked as invalid because of a previous validation failure : No DNSKEY record for key workcomp.virginia.gov. while building chain of trust Apr 10 18:07:11 unbound[72207:0] info: validation failure : signature expired from 2001:500:14:6023:ad::1 for key uprr.pr. while building chain of trust Apr 10 19:34:20 unbound[72207:0] info: validation failure : signatures from unknown keys from 213.141.64.3 Apr 10 19:37:00 unbound[72207:0] info: validation failure : signature expired from 159.142.174.98 for key gsa.dnsops.gov. while building chain of trust Apr 10 19:37:00 unbound[72207:0] info: validation failure : key for validation gsa.dnsops.gov. is marked as invalid because of a previous validation failure : signature expired from 159.142.174.98 for key gsa.dnsops.gov. while building chain of trust Apr 10 20:19:39 unbound[72207:0] info: validation failure : signature expired from 77.249.250.229 for key home.forfunsec.org. while building chain of trust Apr 10 21:04:04 unbound[72207:0] info: validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 10 21:04:11 unbound[72207:0] info: validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 10 22:16:55 unbound[72207:0] info: validation failure : signature expired from 68.87.68.244 for key comcast.org. while building chain of trust Apr 10 22:16:59 unbound[72207:0] info: validation failure : key for validation comcast.org. is marked as invalid because of a previous validation failure : signature expired from 68.87.68.244 for key comcast.org. while building chain of trust Apr 10 22:17:00 unbound[72207:0] info: validation failure : key for validation comcast.org. is marked as invalid because of a previous validation failure : signature expired from 68.87.68.244 for key comcast.org. while building chain of trust Apr 10 22:17:00 unbound[72207:0] info: validation failure : key for validation comcast.org. is marked as invalid because of a previous validation failure : signature expired from 68.87.68.244 for key comcast.org. while building chain of trust Apr 10 22:17:01 unbound[72207:0] info: validation failure : signature expired from 68.87.68.244 for key comcast.org. while building chain of trust Apr 10 22:31:37 unbound[72207:0] info: validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 10 23:06:38 unbound[72207:0] info: validation failure : No DNSKEY record from 128.115.249.61 for key barney.llnl.dnsops.gov. while building chain of trust Apr 10 23:20:57 unbound[72207:0] info: validation failure : signature expired from 62.182.62.23 for key cappaert.se. while building chain of trust Apr 10 23:58:50 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 10 23:58:50 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 10 23:58:53 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 11 00:27:11 unbound[72207:0] info: validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 11 00:27:12 unbound[72207:0] info: validation failure : key for validation virginia.dnsops.gov. is marked as invalid because of a previous validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 11 03:43:07 unbound[72207:0] info: validation failure : No DNSKEY record for key hud.gov. while building chain of trust Apr 11 03:43:07 unbound[72207:0] info: validation failure : No DNSKEY record for key hud.gov. while building chain of trust Apr 11 05:06:58 unbound[72207:0] info: validation failure : No DNSKEY record for key xvx.cz. while building chain of trust Apr 11 05:06:58 unbound[72207:0] info: validation failure : key for validation xvx.cz. is marked as invalid because of a previous validation failure : No DNSKEY record for key xvx.cz. while building chain of trust Apr 11 05:37:02 unbound[72207:0] info: validation failure : signature expired from 152.121.3.100 for key uscg.dnsops.gov. while building chain of trust Apr 11 05:52:04 unbound[72207:0] info: validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:05 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:05 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:06 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:07 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:07 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:08 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:52:09 unbound[72207:0] info: validation failure : key for validation ap.gov. is marked as invalid because of a previous validation failure <0.ap.gov. NSEC IN>: no keys have a DS from 170.110.225.13 for key ap.gov. while building chain of trust Apr 11 05:53:02 unbound[72207:0] info: validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:03 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:03 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:04 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:04 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:06 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:06 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:53:07 unbound[72207:0] info: validation failure : key for validation bollnasrevisionsbyra.se. is marked as invalid because of a previous validation failure <0.bollnasrevisionsbyra.se. NSEC IN>: DS hash mismatches key from 195.198.228.205 for key bollnasrevisionsbyra.se. while building chain of trust Apr 11 05:55:06 unbound[72207:0] info: validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:55:06 unbound[72207:0] info: validation failure : key for validation try2readme.se. is marked as invalid because of a previous validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:55:07 unbound[72207:0] info: validation failure : key for validation try2readme.se. is marked as invalid because of a previous validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:55:08 unbound[72207:0] info: validation failure : key for validation try2readme.se. is marked as invalid because of a previous validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:55:08 unbound[72207:0] info: validation failure : key for validation try2readme.se. is marked as invalid because of a previous validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:55:09 unbound[72207:0] info: validation failure : key for validation try2readme.se. is marked as invalid because of a previous validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:55:10 unbound[72207:0] info: validation failure : key for validation try2readme.se. is marked as invalid because of a previous validation failure <0.try2readme.se. NSEC IN>: no keys have a DS from 195.198.228.205 for key try2readme.se. while building chain of trust Apr 11 05:56:15 unbound[72207:0] info: validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:16 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:16 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:17 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:17 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:18 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:19 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:20 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:20 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:21 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 05:56:21 unbound[72207:0] info: validation failure : key for validation xelerance.se. is marked as invalid because of a previous validation failure <0.xelerance.se. NSEC IN>: no keys have a DS from 193.110.157.135 for key xelerance.se. while building chain of trust Apr 11 06:00:56 unbound[72207:0] info: validation failure : No DNSKEY record from 193.110.157.135 for key aiourt.xelerance.org. while building chain of trust Apr 11 06:07:47 unbound[72207:0] info: validation failure <0.audaglass.cz. NSEC IN>: SERVFAIL no DS from 81.0.238.27 and 81.95.96.2 and 81.95.96.2 and 81.0.238.27 and 81.95.96.2 and 81.0.238.27 and 81.95.96.2 and 81.0.238.27 and 81.0.238.27 for DS 0.audaglass.cz. while building chain of trust Apr 11 06:07:48 unbound[72207:0] info: validation failure : SERVFAIL no DS from 81.95.96.2 and 81.0.238.27 and 81.0.238.27 and 81.95.96.2 and 81.0.238.27 and 81.0.238.27 and 81.0.238.27 and 81.0.238.27 and 81.0.238.27 for DS atds.audaglass.cz. while building chain of trust Apr 11 06:23:20 unbound[72207:0] info: validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:20 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:21 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:21 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:22 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:23 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:23 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:24 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:25 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:25 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:26 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:23:26 unbound[72207:0] info: validation failure : key for validation unicycle.cz. is marked as invalid because of a previous validation failure <0.unicycle.cz. NSEC IN>: no keys have a DS from 2a00:f80:1::6 for key unicycle.cz. while building chain of trust Apr 11 06:27:36 unbound[72207:0] info: validation failure : no signatures from 81.0.238.27 Apr 11 06:43:49 unbound[72207:0] info: validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:50 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:51 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:51 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:52 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:53 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:54 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:55 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:55 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:56 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:43:57 unbound[72207:0] info: validation failure : key for validation hcfa.gov. is marked as invalid because of a previous validation failure <0.hcfa.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key hcfa.gov. while building chain of trust Apr 11 06:55:54 unbound[72207:0] info: validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:55:55 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:55:56 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:55:56 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:55:57 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:55:58 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:55:59 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:56:00 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:56:00 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 06:56:09 unbound[72207:0] info: validation failure : key for validation cms.gov. is marked as invalid because of a previous validation failure <0.cms.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key cms.gov. while building chain of trust Apr 11 07:03:30 unbound[72207:0] info: validation failure <0.trade.gov. NSEC IN>: signature crypto failed for <0.trade.gov. SOA IN> from 67.128.227.187 Apr 11 07:03:32 unbound[72207:0] info: validation failure : signature crypto failed for from 63.146.245.4 Apr 11 07:03:33 unbound[72207:0] info: validation failure : signature crypto failed for from 67.128.227.187 Apr 11 07:03:34 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.64.30 Apr 11 07:03:35 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.64.30 Apr 11 07:03:37 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.214.3 Apr 11 07:03:38 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.214.3 Apr 11 07:03:39 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.64.30 Apr 11 07:03:41 unbound[72207:0] info: validation failure : signature crypto failed for from 63.146.245.4 Apr 11 07:03:43 unbound[72207:0] info: validation failure : no DNSSEC records from 63.146.245.4 for DS blog.trade.gov. while building chain of trust Apr 11 07:03:44 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.64.30 Apr 11 07:03:45 unbound[72207:0] info: validation failure : signature crypto failed for from 63.146.245.4 Apr 11 07:03:46 unbound[72207:0] info: validation failure : signature crypto failed for from 170.110.64.30 Apr 11 07:04:53 unbound[72207:0] info: validation failure <0.timefreq.bldrdoc.gov. NSEC IN>: signature expired for <0.timefreq.bldrdoc.gov. SOA IN> from 132.163.4.9 Apr 11 07:04:54 unbound[72207:0] info: validation failure : signature expired for from 132.163.4.9 Apr 11 07:04:55 unbound[72207:0] info: validation failure : signature expired for from 129.6.13.2 Apr 11 07:04:57 unbound[72207:0] info: validation failure : signature expired for from 132.163.4.9 Apr 11 07:04:58 unbound[72207:0] info: validation failure : signature expired for from 132.163.4.10 Apr 11 07:06:33 unbound[72207:0] info: validation failure : no signatures from 81.0.238.27 Apr 11 07:07:44 unbound[72207:0] info: validation failure <0.audaglas.cz. NSEC IN>: SERVFAIL no DS from 81.0.238.27 and 81.0.238.27 and 81.0.238.27 and 81.95.96.2 and 81.95.96.2 and 81.0.238.27 and 81.0.238.27 and 81.95.96.2 and 81.0.238.27 for DS 0.audaglas.cz. while building chain of trust Apr 11 07:10:40 unbound[72207:0] info: validation failure : No DNSKEY record for key valid.antd.nist.gov. while building chain of trust Apr 11 07:11:15 unbound[72207:0] info: validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:16 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:16 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:17 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:18 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:19 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:20 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:20 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:21 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:11:22 unbound[72207:0] info: validation failure : key for validation medicare.gov. is marked as invalid because of a previous validation failure <0.medicare.gov. NSEC IN>: no keys have a DS from 146.123.140.201 for key medicare.gov. while building chain of trust Apr 11 07:14:46 unbound[72207:0] info: validation failure <0.usps.gov. NSEC IN>: no signatures over NSEC3s from 56.0.100.25 for DS 0.usps.gov. while building chain of trust Apr 11 07:14:48 unbound[72207:0] info: validation failure : no signatures from 56.0.100.25 for DS mdyq.usps.gov. while building chain of trust Apr 11 07:14:49 unbound[72207:0] info: validation failure : no signatures from 56.0.82.25 for DS oean.usps.gov. while building chain of trust Apr 11 07:14:51 unbound[72207:0] info: validation failure : no signatures over NSEC3s from 56.0.141.25 for DS xtrm.usps.gov. while building chain of trust Apr 11 07:14:52 unbound[72207:0] info: validation failure : no signatures from 56.0.100.25 for DS zzvq.usps.gov. while building chain of trust Apr 11 07:14:54 unbound[72207:0] info: validation failure : no signatures from 56.0.141.25 Apr 11 07:14:56 unbound[72207:0] info: validation failure : no signatures over NSEC3s from 56.0.82.25 for DS bpki.usps.gov. while building chain of trust Apr 11 07:14:58 unbound[72207:0] info: validation failure : no signatures from 56.0.82.25 for DS zmmg.usps.gov. while building chain of trust Apr 11 07:24:39 unbound[72207:0] info: validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:39 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:40 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:41 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:41 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:42 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:42 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:44 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:24:44 unbound[72207:0] info: validation failure : key for validation domein.w.bg. is marked as invalid because of a previous validation failure <0.domein.w.bg. NSEC IN>: no keys have a DS from 192.92.129.1 for key domein.w.bg. while building chain of trust Apr 11 07:29:00 unbound[72207:0] info: validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:01 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:02 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:03 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:03 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:04 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:05 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:06 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:07 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:07 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:08 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 07:29:09 unbound[72207:0] info: validation failure : key for validation cmms.gov. is marked as invalid because of a previous validation failure <0.cmms.gov. NSEC IN>: no keys have a DS from 146.123.140.200 for key cmms.gov. while building chain of trust Apr 11 22:12:01 unbound[72207:0] info: validation failure : signature expired from 62.182.62.23 for key cappaert.se. while building chain of trust Apr 11 22:20:53 unbound[72207:0] info: validation failure : signature expired from 195.39.74.205 for key och.cz. while building chain of trust Apr 11 23:58:48 unbound[72207:0] info: validation failure : No DNSKEY record for key cicf.virginia.gov. while building chain of trust Apr 11 23:58:48 unbound[72207:0] info: validation failure : key for validation cicf.virginia.gov. is marked as invalid because of a previous validation failure : No DNSKEY record for key cicf.virginia.gov. while building chain of trust Apr 12 00:46:49 unbound[72207:0] info: validation failure : signature expired from 152.121.3.100 for key uscg.dnsops.gov. while building chain of trust Apr 12 01:15:37 unbound[72207:0] info: validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 12 01:17:56 unbound[72207:0] info: validation failure : signature expired from 147.229.252.34 for key bces.cz. while building chain of trust Apr 12 01:28:10 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 12 01:28:10 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 12 01:28:13 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 12 01:38:19 unbound[72207:0] info: validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 12 01:38:23 unbound[72207:0] info: validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 12 02:54:56 unbound[72207:0] info: validation failure : No DNSKEY record for key workcomp.virginia.gov. while building chain of trust Apr 12 02:54:57 unbound[72207:0] info: validation failure : key for validation workcomp.virginia.gov. is marked as invalid because of a previous validation failure : No DNSKEY record for key workcomp.virginia.gov. while building chain of trust Apr 12 04:24:41 unbound[72207:0] info: validation failure : signature expired from 77.249.250.229 for key home.forfunsec.org. while building chain of trust Apr 12 07:15:04 unbound[72207:0] info: validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 12 07:15:16 unbound[72207:0] info: validation failure : key for validation mymail.in.th. is marked as invalid because of a previous validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 12 07:15:17 unbound[72207:0] info: validation failure : key for validation mymail.in.th. is marked as invalid because of a previous validation failure : No DNSKEY record for key mymail.in.th. while building chain of trust Apr 12 08:26:43 unbound[72207:0] info: validation failure : no keys have a DS from 2001:470:1f06:4c7::38 for key unicycle.cz. while building chain of trust Apr 12 10:13:36 unbound[72207:0] info: validation failure : no keys have a DS from 2a00:f80:1::7 for key unicycle.cz. while building chain of trust Apr 12 10:46:36 unbound[72207:0] info: validation failure : signature expired from 83.241.177.38 for key keyserver.se. while building chain of trust Apr 12 12:07:21 unbound[72207:0] info: validation failure : signature expired from 217.16.192.26 for key better.se. while building chain of trust Apr 12 12:10:33 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 12 12:10:33 unbound[72207:0] info: validation failure : No DNSKEY record for key uspto.gov. while building chain of trust Apr 12 12:36:40 unbound[72207:0] info: validation failure : signature expired from 159.142.174.98 for key gsa.dnsops.gov. while building chain of trust Apr 12 12:36:41 unbound[72207:0] info: validation failure : key for validation gsa.dnsops.gov. is marked as invalid because of a previous validation failure : signature expired from 159.142.174.98 for key gsa.dnsops.gov. while building chain of trust Apr 12 13:12:54 unbound[72207:0] info: validation failure : No DNSKEY record for key epost.bg. while building chain of trust Apr 12 13:45:49 unbound[72207:0] info: validation failure : signature expired from 81.19.8.169 for key och.cz. while building chain of trust Apr 12 15:46:08 unbound[72207:0] info: validation failure : signature expired from 62.116.238.216 for key skvadronsbacken.se. while building chain of trust Apr 12 16:33:58 unbound[72207:0] info: validation failure : signature crypto failed from 143.118.2.1 for key ncw.se. while building chain of trust Apr 12 16:36:14 unbound[72207:0] info: validation failure : signatures from unknown keys from 213.141.64.3 Apr 12 16:47:51 unbound[72207:0] info: validation failure : signature expired from 134.202.6.100 for key uprr.pr. while building chain of trust Apr 12 17:44:34 unbound[72207:0] info: validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 12 17:44:36 unbound[72207:0] info: validation failure : key for validation virginia.dnsops.gov. is marked as invalid because of a previous validation failure : signature expired from 166.67.65.187 for key virginia.dnsops.gov. while building chain of trust Apr 12 17:50:17 unbound[72207:0] info: validation failure : signature expired from 80.177.246.130 for key cloudba.se. while building chain of trust Apr 12 17:50:18 unbound[72207:0] info: validation failure : key for validation cloudba.se. is marked as invalid because of a previous validation failure : signature expired from 80.177.246.130 for key cloudba.se. while building chain of trust Apr 12 20:20:38 unbound[72207:0] info: validation failure : No DNSKEY record for key xvx.cz. while building chain of trust Apr 12 20:20:39 unbound[72207:0] info: validation failure : key for validation xvx.cz. is marked as invalid because of a previous validation failure