Subject: [ietf-dkim] Timeouts retrieving keys from ietf.org

From: Jim Fenton <[email-masked]>
Date: Sun, 15 Sep 2013 11:44:43 -0700

Slightly off-topic for this list, but the dkim-ops mailing list seems to
be dormant...

I'm getting a fair number of DKIM key lookup failures from ietf.org.  I
have run into this on two different mail servers with independent
resolver configurations, so I'm inclined to think the problem is not on
my end:

Sep  7 12:58:19 v2 opendkim[1019]: r87JwCmq008446: key retrieval failed
(s=ietf1, d=ietf.org): timeout DNS query for `ietf1._domainkey.ietf.org'

If anyone else is seeing this, let me know and I'll report it.  My
theory is that their DNS servers are struggling to respond to many key
requests after sending out signed messages to large mailing lists. The
TTL is 30 minutes, which may be too short.

-Jim
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "John R. Levine" <[email-masked]>
Date: 15 Sep 2013 15:53:57 -0400

> (s=ietf1, d=ietf.org): timeout DNS query for `ietf1._domainkey.ietf.org'

I did a little poking around and the problem appears to me that the IPv6 
address for ns0.ietf.org, 2001:1890:126c::1:2, doesn't work.  I tried it 
from a couple of places on different networks, no luck anywhere.

There appear to be v6 routing problems for some of the secondaries, too.

ns1.ams1.afilias-nst.info. is has IPv6 address 2a01:8840:7::1, and 
although I can query it via a v6 tunnel at HE, I can't see if from the 
native IPv6 on my T-W cable modem.  The T-W v6 is OK, since it queries
ns1.yyz1.afilias-nst.info 2a01:8840:9::1 without problems.

On the other hand, you might also file a bug report with whoever runs your 
local DNS server.  If a v6 query fails and a host has a v4 address, it 
really should try the v4 address next.

R's,
John

---

From: "John R. Levine" <[email-masked]>
Date: 15 Sep 2013 15:59:50 -0400

Traceroutes confirm that it's dead, I sent a note to ietf-action.

> TTL is 30 minutes, which may be too short.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: SM <[email-masked]>
Date: Sun, 15 Sep 2013 12:18:44 -0700

Hi Jim,
>(s=ietf1, d=ietf.org): timeout DNS query for `ietf1._domainkey.ietf.org'

I am seeing it in my logs too.

Regards,
-sm