DNSSEC validation error messages by default will show up in syslog as a Query-Error. It will have the string "error" at the start of the message. Here is an example of what it may look like:
error (insecurity proof failed) resolving './NS/IN': 192.168.1.13#53
Usually, this level of error logging should suffice for most. If you would like to get more detailed information about why DNSSEC validation failed, read on to the section called “BIND DNSSEC Debug Logging” to learn more.
A word of caution: before you enable debug logging, be aware that this may dramatically increase the load on your name servers.
With that said, sometimes it may become necessary to temporarily enable BIND debug logging to see more details of how DNSSEC is validating (or not). DNSSEC-related messages are not recorded in syslog by default, even if query log is enabled, only DNSSEC errors will show up in syslog. Enabling debug logging is not recommended for production servers, as it increases load on the server.
The example below shows how to enable debug level 3 (to see full DNSSEC validation messages) in BIND 9 and have it sent to syslog:
logging { channel dnssec_log { syslog daemon; severity debug 3; print-category yes; }; category dnssec { dnssec_log; }; };
The example below shows how to log DNSSEC messages to their own file:
logging { channel dnssec_log { file "/var/log/dnssec.log"; severity debug 3; }; category dnssec { dnssec_log; }; };
After restarting BIND, a large number of log messages will appear
in syslog. The example below shows the log messages as a result of
successfully looking up and validating the domain name
www.isc.org
.
validating @0xb8012d88: . NS: starting validating @0xb8012d88: . NS: attempting positive response validation validating @0xb805a9b0: . DNSKEY: starting validating @0xb805a9b0: . DNSKEY: attempting positive response validation validating @0xb805a9b0: . DNSKEY: verify rdataset (keyid=19036): success validating @0xb805a9b0: . DNSKEY: signed by trusted key; marking as secure validator @0xb805a9b0: dns_validator_destroy validating @0xb8012d88: . NS: in fetch_callback_validator validating @0xb8012d88: . NS: keyset with trust 8 validating @0xb8012d88: . NS: resuming validate validating @0xb8012d88: . NS: verify rdataset (keyid=8230): success validating @0xb8012d88: . NS: marking as secure, noqname proof not needed validator @0xb8012d88: dns_validator_destroy validating @0xb8012d88: www.isc.org A: starting validating @0xb8012d88: www.isc.org A: attempting positive response validation validating @0xb805a9b0: isc.org DNSKEY: starting validating @0xb805a9b0: isc.org DNSKEY: attempting positive response validation validating @0xb827e298: isc.org DS: starting validating @0xb827e298: isc.org DS: attempting positive response validation validating @0xb827fd18: org DNSKEY: starting validating @0xb827fd18: org DNSKEY: attempting positive response validation validating @0xb8281798: . NS: starting validating @0xb8281798: . NS: attempting positive response validation validating @0xb8281798: . NS: keyset with trust 8 validating @0xb8280790: org DS: starting validating @0xb8280790: org DS: attempting positive response validation validating @0xb8280790: org DS: keyset with trust 8 validating @0xb8280790: org DS: verify rdataset (keyid=8230): success validating @0xb8280790: org DS: marking as secure, noqname proof not needed validator @0xb8280790: dns_validator_destroy validating @0xb827fd18: org DNSKEY: in dsfetched validating @0xb827fd18: org DNSKEY: dsset with trust 8 validating @0xb827fd18: org DNSKEY: verify rdataset (keyid=21366): success validating @0xb827fd18: org DNSKEY: marking as secure (DS) validator @0xb827fd18: dns_validator_destroy validating @0xb827e298: isc.org DS: in fetch_callback_validator validating @0xb827e298: isc.org DS: keyset with trust 8 validating @0xb827e298: isc.org DS: resuming validate validating @0xb827e298: isc.org DS: verify rdataset (keyid=33287): success validating @0xb827e298: isc.org DS: marking as secure, noqname proof not needed validator @0xb827e298: dns_validator_destroy validating @0xb805a9b0: isc.org DNSKEY: in dsfetched validating @0xb805a9b0: isc.org DNSKEY: dsset with trust 8 validating @0xb805a9b0: isc.org DNSKEY: verify rdataset (keyid=12892): success validating @0xb805a9b0: isc.org DNSKEY: marking as secure (DS) validator @0xb805a9b0: dns_validator_destroy validating @0xb8012d88: www.isc.org A: in fetch_callback_validator