{"action":"created","issue":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/4315","repository_url":"https://api.github.com/repos/PowerDNS/pdns","labels_url":"https://api.github.com/repos/PowerDNS/pdns/issues/4315/labels{/name}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/4315/comments","events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/4315/events","html_url":"https://github.com/PowerDNS/pdns/issues/4315","id":171188195,"number":4315,"title":"Auth: recursor reply dropped for protonmail.ch DNSKEY query","user":{"login":"jhass","id":141294,"avatar_url":"https://avatars.githubusercontent.com/u/141294?v=3","gravatar_id":"","url":"https://api.github.com/users/jhass","html_url":"https://github.com/jhass","followers_url":"https://api.github.com/users/jhass/followers","following_url":"https://api.github.com/users/jhass/following{/other_user}","gists_url":"https://api.github.com/users/jhass/gists{/gist_id}","starred_url":"https://api.github.com/users/jhass/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhass/subscriptions","organizations_url":"https://api.github.com/users/jhass/orgs","repos_url":"https://api.github.com/users/jhass/repos","events_url":"https://api.github.com/users/jhass/events{/privacy}","received_events_url":"https://api.github.com/users/jhass/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/PowerDNS/pdns/labels/auth","name":"auth","color":"eb6420"},{"url":"https://api.github.com/repos/PowerDNS/pdns/labels/defect","name":"defect","color":"cccccc"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/PowerDNS/pdns/milestones/8","html_url":"https://github.com/PowerDNS/pdns/milestones/auth-4.1.0","labels_url":"https://api.github.com/repos/PowerDNS/pdns/milestones/8/labels","id":1460919,"number":8,"title":"auth-4.1.0","description":"","creator":{"login":"Habbie","id":525838,"avatar_url":"https://avatars.githubusercontent.com/u/525838?v=3","gravatar_id":"","url":"https://api.github.com/users/Habbie","html_url":"https://github.com/Habbie","followers_url":"https://api.github.com/users/Habbie/followers","following_url":"https://api.github.com/users/Habbie/following{/other_user}","gists_url":"https://api.github.com/users/Habbie/gists{/gist_id}","starred_url":"https://api.github.com/users/Habbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Habbie/subscriptions","organizations_url":"https://api.github.com/users/Habbie/orgs","repos_url":"https://api.github.com/users/Habbie/repos","events_url":"https://api.github.com/users/Habbie/events{/privacy}","received_events_url":"https://api.github.com/users/Habbie/received_events","type":"User","site_admin":false},"open_issues":189,"closed_issues":33,"state":"open","created_at":"2015-12-15T09:11:57Z","updated_at":"2016-08-15T17:43:14Z","due_on":null,"closed_at":null},"comments":7,"created_at":"2016-08-15T15:00:28Z","updated_at":"2016-08-15T17:46:05Z","closed_at":null,"body":"I have a PowerDNS auth 4.0.1 with an Unbound 1.5.9 on port 5353 as a recursor, all on a i686 Archlinux VM.\r\n\r\n```\r\n$ dig +dnssec protonmail.ch A @localhost -p53\r\n\r\n; <<>> DiG 9.10.4-P2 <<>> +dnssec protonmail.ch A @localhost -p53\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63317\r\n;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 5\r\n\r\n;; OPT PSEUDOSECTION:\r\n; EDNS: version: 0, flags: do; udp: 4096\r\n;; QUESTION SECTION:\r\n;protonmail.ch.\t\t\tIN\tA\r\n\r\n;; ANSWER SECTION:\r\nprotonmail.ch.\t\t1200\tIN\tA\t185.70.40.181\r\nprotonmail.ch.\t\t1200\tIN\tRRSIG\tA 8 2 1200 20160913025848 20160814025848 6753 protonmail.ch. DVe8eMjJDQAQwAoGeG5vtsyu3olupjsIsBZqhlPV7M5FA+cdbXuiNdSr AgQITpDDkj+EBTIu/QkGx2fBGWABdb/SqsonyeFjpfbQT+HsnPWegSY6 oDqKTYa7bS2CJpiLL6UrCwa0BlX5g/pvPkS6nBvqHoljtwKBp2/Ara8O 38qM2KPRl8vd/HymI/xwvOTrsOH5ZY93kKymdfB/U67R2tqEbBcgEw2b P6riex3v/T9jM+Z6OJSLZbbC8g+Ox9nnEaLgplqQ7LXwDJGomFZXyiWn Bb/cIDGr2y8pmif8sdMQ+Vo9FYRhDjhQ8gtJKeFjAUsF8u54ySeXgEYF fgIMig==\r\n\r\n;; AUTHORITY SECTION:\r\nprotonmail.ch.\t\t1200\tIN\tNS\tns2.protonmail.ch.\r\nprotonmail.ch.\t\t1200\tIN\tNS\tns1.protonmail.ch.\r\nprotonmail.ch.\t\t1200\tIN\tRRSIG\tNS 8 2 1200 20160913025848 20160814025848 6753 protonmail.ch. hlBBzrg9N92jFjqmbvM0nYrmX/DbvhtxEAG+g43CziARFi6zj8p0uslF GSMlFLoBy6fOQGMSvjFF0BYpGgxHdy2zzTaaXqNP1r44IwxuOFOD3bQe adKFChHhBbL/bpERdpkfXUGg06Jo781bmZKezE6YhmarIMkXRTL74MH/ MDcm/uR8zwTfUmgDTygRgwwlfsSrckYGSULurm6EQ6QotOQWkuJmZtML Bqq2QJ0Bv5oQXGKzSIQg9igD1lU8ElyJMiti3xqa6qf7WUk1WjWqGU77 4unYULT4laU49moz7DFV0QN48qRBtn2n7NC0VzSbfm/RrWX72ImqhAGw 6EHlzw==\r\n\r\n;; ADDITIONAL SECTION:\r\nns1.protonmail.ch.\t1200\tIN\tA\t37.35.106.40\r\nns2.protonmail.ch.\t1200\tIN\tA\t185.70.40.19\r\nns1.protonmail.ch.\t1200\tIN\tRRSIG\tA 8 3 1200 20160913025848 20160814025848 6753 protonmail.ch. ngb9KxP286OWf/Ut8J4g04PWECz22tJmq8olqo5FuRrAdgPeRMdfOulZ LXXQgDjcBIiwjENwbkGwhvQwdAkuKR7BAUK7r5Yz2XzXCjpsa+pqVSmS hvoyQTcLUJg8E8/Qts6Ze/d97pMCD392BU5kAyydrq446uwYTI6dXRNg SSNV/GMjqRJQVjTfLysXinP7Vex0hzZiUgDrBLpKge4mQ5SmBxqrc1Kd rOc32coXPLLvVP8nnqh53B3mNeXBpL7djFvsibCubjOg9dd0PayO57w0 47Vdzb3w6YtpJSCerS/NENzlb26W1DHcZFi+qolle+CirdHQSxskaNS7 eUskVg==\r\nns2.protonmail.ch.\t1200\tIN\tRRSIG\tA 8 3 1200 20160913025848 20160814025848 6753 protonmail.ch. L1JHInzcqTbUVfjHnIQhFU0uYAG8or8qV8EQlvRjX0XvFxj79wCnpeYL uKfD7YnTmrH45n/KlrYLC9LBNK9LvSayKW8Z/UJnNLyUjXONMfgXiw9R ATGaB9ySvWMHVldMCvbsFEAbOwk1OlhWbUpf5kAj6/JvfHB4jyXOLxtV EIqhfJL1kGdq6JCocp7DqOKHEhevcE4zD5XRKh3d3xfHXM/7IwKoyQxq V9dN72Sl+CHMyezCA1BVL811+gyTgmb9iCdB+v8TK9XD5pSF6uoYhFIg RqEhyGKod9xU2HdWtQE17faDpbbrLrVskb31E8HyZtfXPtbX+7OTS/ZN xo39lQ==\r\n\r\n;; Query time: 19 msec\r\n;; SERVER: ::1#53(::1)\r\n;; WHEN: Mon Aug 15 16:56:18 CEST 2016\r\n;; MSG SIZE  rcvd: 1330\r\n\r\n$ dig +dnssec protonmail.ch DNSKEY @localhost -p5353\r\n\r\n; <<>> DiG 9.10.4-P2 <<>> +dnssec protonmail.ch DNSKEY @localhost -p5353\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5684\r\n;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1\r\n\r\n;; OPT PSEUDOSECTION:\r\n; EDNS: version: 0, flags: do; udp: 4096\r\n;; QUESTION SECTION:\r\n;protonmail.ch.\t\t\tIN\tDNSKEY\r\n\r\n;; ANSWER SECTION:\r\nprotonmail.ch.\t\t1058\tIN\tDNSKEY\t256 3 8 AwEAAbkQec8erGeyr6RAOEFWOvCDiN1IPb265vqwFEqPRaGh64dVe8mT Z8xFAJm0QKPqfrso2GNFtlM13eZgpYpWgdTVIz3EyafRb+nKvrqC5gLz bzPl96681L8MejLoCr66awxwWaQC4Na6W1XNcUXqtA/yCOfMW5+JyuCl L8KP/SWBo0+TdXytqnaKzWfFH0Mg7ucmH/LZx6mR3lLu8kzTIEOL13Z9 D1AyEJ1IlMqR2E3zE6FzsgLP+pJi0Ztw4MrnFyWAJROk54SexNSAcKl/ D4uTl+zNMVNfR+Pug0sD4Pjxu9xyRnPRxTlcISgXsO8VYh3AV9x20wek hFYeBn0WHWk=\r\nprotonmail.ch.\t\t1058\tIN\tDNSKEY\t257 3 8 AwEAAd6b3gYWrIsnj3gfzy42lKvoFE59bEC1+5KUScM41cEISCg4cNlP LBGWgpTCI+G8ijzkYWJ8bmUkBrkYGVuH3P09I8uznwWF5HJNgxqkDUQ9 V+v0pxVHJGRmgAAnClSa1pSJm6Rb9n11eflk0ZYT7flMrd8/ou8tRrIv 7YrSl6vmGGQxiBWs6mFEIosVT0+3CRnH/g0K6NJB2LLSH73bVFUhJ0Se pihIU8r8rBl1k2xwOC3BZ5ZLWroZFlvUUbDPJzsJsmwWL8VSLVWAwhIb EOnI9v89X6ci1D0W+PrmdbuuFMwglVzgksCRES9YlEwP/uRRCrZldL2i qS1TVBnDAQTMqT9oR9UrE5Fj7g/3ZUrtw+111RbJzQgy37/0h6KDXAjh r20DZ9X/eCbVGNhwJzWRhAAOtMhxWw4EsjYaIEDJO/rqYRkpiD3GV6Rw dYNU+cCCxq6u/xfebzR0kFJTmVl223+t2LNTFG4jH8aa0rs3ve2YJGJ5 5e61ttdYHOWCG+bsdxrI4EMIRH2RZX/ExDcduO2ntgfG5oV5o/gTeXk/ RnTq2G2taGDcNeRH8bv6ywtsID4szx6ZmIx9O4Zu82RgrVoPlJh+vCJ2 CrptGU9rOs3/jqtu7azP0kLgzN+BIsUIHDuBkeH0F1kGOi4htefAuqsv ocBObeBaBDjiepsv\r\nprotonmail.ch.\t\t1058\tIN\tRRSIG\tDNSKEY 8 2 1200 20160913025848 20160814025848 6753 protonmail.ch. B2ZsfkAaeAW9yxthU5VAv0rm5JxiT3HPian1lngAzStjqrMQAtjtGGjd Y/ti+HAZ/umhPSqTsG9Rawctch59LJQ8Nq1EQlcge6DreWDFA1FtnZCK 87JTQ8n2qhvTVRzCT/4IH6hK3I5Uqq4yk3gZxwe1rOsjZcGhabm8O2AS fNpqrNp6cSqvGMGBPISbgFb90aKHJLBJ6c591EkLel7cJYSR864hGlh5 N/R4oeun0S7y8A3jrskVmeZj+tW3kzxhoiD9wg6NH1tqMm/bFJ+gmtQW FP241N1eQQhRMYQYlgZQ6yv2+jozzQck2IzW5HlMeLC+s+YsJ2DF1E6/ Ga+toA==\r\nprotonmail.ch.\t\t1058\tIN\tRRSIG\tDNSKEY 8 2 1200 20160913025848 20160814025848 27196 protonmail.ch. nJiFT2vdp7XSTeTxWxJTxMpv2KPVCJQcPN009tSFsLKDHYrb3KyzzGXB y/0IOLR3WtasIHALwitIQGkwAGJuntmsLxKo//d1198VTv6Rj7lvy5p+ y32O+FyD/5CMaWDQ5f8mbDdOIcLCGkDTP2iYC78dk83LNX2u4QjteBTP 6sxlylFO/xYbAMVB5OtrbQ2jiCqZGCmkeUBoYBe5P7WU3NSNYaOE2EXy AulC2sE07mY2ehzOplbkCHH8TXm5AJt9bxXyee3HY8ZGhiL63LurNsnf PFdKFiHB9jXTpv4o8RML/tuEBzI7bIPRQ6LBLIsBP1o2yx2LZW+HTB2b IoYt9YeS11gFq3BaR0n2M5ELsAZTCv8TLW3L3ip/L7aeDlU/bMRJR/ro mZQvFfcdnmPEj46RbbrNkZlxTBe6fzedkEfTjidkaTOrqW371S4D5EgL Oov760E8Ae++OvM1Ks2FcDv00oBYLgPFlo4cgAuL/lMkZV3DcqxiWut9 Q6eF4YtSyGYxH3X4ybqqObEETaN06aaniIZoPgXtj8rHLu9R3etHXomy KWHQjA6ClhyqGN0WdPtJw3vVvBEYhAD5YxRd2fpxaUQdColzkZaDOA5L 1EZC9xkqV8kfNvYMlQh/MmgO/gN4MzxxrCtUDDC7Fkwi5sMfTqrdQLK9 mXgz0jmDg0I=\r\n\r\n;; Query time: 0 msec\r\n;; SERVER: 127.0.0.1#5353(127.0.0.1)\r\n;; WHEN: Mon Aug 15 16:56:49 CEST 2016\r\n;; MSG SIZE  rcvd: 1708\r\n\r\n$ dig +dnssec protonmail.ch DNSKEY @localhost -p53\r\n\r\n; <<>> DiG 9.10.4-P2 <<>> +dnssec protonmail.ch DNSKEY @localhost -p53\r\n;; global options: +cmd\r\n;; connection timed out; no servers could be reached\r\n```\r\n\r\nPowerDNS logs\r\n```\r\nAug 15 16:57:21 Discarding packet from recursor backend with id 60969, qname or qtype mismatch (0 v 48, (empty) v protonmail.ch)\r\n```\r\n\r\nHere's a PCAP between PowerDNS and Unbound: http://cloud.aeshna.de/u/mrzyx/pdns.pcap\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/comments/239873142","html_url":"https://github.com/PowerDNS/pdns/issues/4315#issuecomment-239873142","issue_url":"https://api.github.com/repos/PowerDNS/pdns/issues/4315","id":239873142,"user":{"login":"Habbie","id":525838,"avatar_url":"https://avatars.githubusercontent.com/u/525838?v=3","gravatar_id":"","url":"https://api.github.com/users/Habbie","html_url":"https://github.com/Habbie","followers_url":"https://api.github.com/users/Habbie/followers","following_url":"https://api.github.com/users/Habbie/following{/other_user}","gists_url":"https://api.github.com/users/Habbie/gists{/gist_id}","starred_url":"https://api.github.com/users/Habbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Habbie/subscriptions","organizations_url":"https://api.github.com/users/Habbie/orgs","repos_url":"https://api.github.com/users/Habbie/repos","events_url":"https://api.github.com/users/Habbie/events{/privacy}","received_events_url":"https://api.github.com/users/Habbie/received_events","type":"User","site_admin":false},"created_at":"2016-08-15T17:46:05Z","updated_at":"2016-08-15T17:46:05Z","body":"As this is a long standing issue that nobody noticed before, and as `recursor` is generally not recommended, -and- you have a workaround, please understand this will not be high priority for us."}}
{"actor":{"display_login":"Habbie"}}