Certain Domains Don't Resolve With DNSSec Enabled

[HarryMuscle]

I'm setting up my RT-AX86U router to use ControlD DNS servers. Everything is working great, but I noticed two domains that wouldn't resolve (theweathernetwork.com and aqueon.com) even though I'm not filtering anything. After a bit of troubleshooting, it turns out this is somehow because of DNSSec being enabled. As soon as I disable DNSSec, the domains resolve. Leaving DNSSec enabled but validating unsigned replies didn't work, it's only when I fully disable DNSSec that these domains get resolved. Any way to figure out if this is a bug on the router or on the DNS server?

Thanks,
Harry

 

[bbunge]

I'm setting up my RT-AX86U router to use ControlD DNS servers. Everything is working great, but I noticed two domains that wouldn't resolve (theweathernetwork.com and aqueon.com) even though I'm not filtering anything. After a bit of troubleshooting, it turns out this is somehow because of DNSSec being enabled. As soon as I disable DNSSec, the domains resolve. Leaving DNSSec enabled but validating unsigned replies didn't work, it's only when I fully disable DNSSec that these domains get resolved. Any way to figure out if this is a bug on the router or on the DNS server?

Thanks,
Harry

DNSSEC is working well with well established upstream resolver. Most likely the ControlD resolver. Your best bet is to use something other than one with gimmicks.

 

[HarryMuscle]

DNSSEC is working well with well established upstream resolver. Most likely the ControlD resolver. Your best bet is to use something other than one with gimmicks.

Yup, it's on ControlD's end. Since they filter stuff (like ads, etc) it can mess with DNSSec apparently ... I'm guessing a subdomain of the domains that weren't resolving was blocked (probably cause it's used to display ads) and that caused the main domains to not pass the DNSSec signature check.