Hi,

actually I am inside klfree net so the same problem is with non-existent domain klfree.czf:

policy.add(policy.suffix(

policy.QTRACE,

{todname('klfree.czf')}

))

-- policy.FORWARD({'10.102.0.252', '10.102.0.253'}),

policy.FORWARD('10.102.0.252'),

{todname('klfree.czf')}

))

and log

direct request:

$ dig silver.klfree.czf @10.102.0.252

; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> silver.klfree.czf @10.102.0.252

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60977

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 4096

;; QUESTION SECTION:

;silver.klfree.czf. IN A

;; ANSWER SECTION:

silver.klfree.czf. 14400 IN A 10.102.25.1

;; AUTHORITY SECTION:

klfree.czf. 14400 IN NS ns1.klfree.czf.

klfree.czf. 14400 IN NS ns2.klfree.czf.

;; ADDITIONAL SECTION:

ns1.klfree.czf. 14400 IN A 10.102.0.254

ns2.klfree.czf. 14400 IN A 10.102.0.253

;; Query time: 2 msec

;; SERVER: 10.102.0.252#53(10.102.0.252)

;; WHEN: Sun Nov 04 10:17:38 CET 2018

;; MSG SIZE rcvd: 130

and using kresd:

$ dig silver.klfree.czf

; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> silver.klfree.czf

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35374

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;silver.klfree.czf. IN A

;; Query time: 9 msec

;; SERVER: 127.0.0.53#53(127.0.0.53)

;; WHEN: Sun Nov 04 10:18:35 CET 2018

;; MSG SIZE rcvd: 35

and here is the kresd log:

Nov 4 10:18:35 ud kresd[1116]: [ 0][plan] plan 'silver.klfree.czf.' type 'A'

Nov 4 10:18:35 ud kresd[1116]: [38235][iter] 'silver.klfree.czf.' type 'A' id was assigned, parent id 0

Nov 4 10:18:35 ud kresd[1116]: [38235][cach] => trying zone: ., NSEC, hash 0

Nov 4 10:18:35 ud kresd[1116]: [38235][cach] => NSEC sname: range search found stale or insecure entry

Nov 4 10:18:35 ud kresd[1116]: [38235][cach] => skipping zone: ., NSEC, hash 0;new TTL -123456789, ret -2

Nov 4 10:18:35 ud kresd[1116]: [38235][plan] plan '.' type 'DNSKEY'

Nov 4 10:18:35 ud kresd[1116]: [ 3792][iter] '.' type 'DNSKEY' id was assigned, parent id 38235

Nov 4 10:18:35 ud kresd[1116]: [ 3792][cach] => satisfied by exact RRset: rank 060, new TTL 170805

Nov 4 10:18:35 ud kresd[1116]: [ 3792][iter] <= answer received:

Nov 4 10:18:35 ud kresd[1116]: ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 3792

Nov 4 10:18:35 ud kresd[1116]: ;; Flags: qr aa QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0

Nov 4 10:18:35 ud kresd[1116]: ;; QUESTION SECTION

Nov 4 10:18:35 ud kresd[1116]: .#011#011DNSKEY

Nov 4 10:18:35 ud kresd[1116]: ;; ANSWER SECTION

Nov 4 10:18:35 ud kresd[1116]: . #011170805#011DNSKEY#011256 3 8 AwEAAdp440E6Mz7c+Vl4sPd0lTv2Qnc85dTW64j0RDD7sS/zwxWDJ3QRES2VKDO0OXLMqVJSs2YCCSDKuZXpDPuf++YfAu0j7lzYYdWTGwyNZhEaXtMQJIKYB96pW6cRkiG2Dn8S2vvo/PxW9PKQsyLbtd8PcwWglHgReBVp7kEv/Dd+3b3YMukt4jnWgDUddAySg558Zld+c9eGWkgWoOiuhg4rQRkFstMX1pRyOSHcZuH38o1WcsT4y3eT0U/SR6TOSLIB/8Ftirux/h297oS7tCcwSPt0wwry5OFNTlfMo8v7WGurogfk8hPipf7TTKHIi20LWen5RCsvYsQBkYGpF78=

Nov 4 10:18:35 ud kresd[1116]: . #011170805#011DNSKEY#011257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=

Nov 4 10:18:35 ud kresd[1116]: . #011170805#011DNSKEY#011257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=

Nov 4 10:18:35 ud kresd[1116]: . #011172800#011RRSIG#011DNSKEY 8 0 172800 20181121000000 20181031000000 20326 . V2mFe8AVsbdN0t7lZQz9uxIN0PUmb5xR9e70Hm07sgPkqerHKdBqXZjTTfwnixLkyiCP43zTJhBZH8OQbTy9aCI6P0FxjPV4qPdEdb4L+3c8bybYMdFtUgI3JFmJcTVtaibgtCZjLjZIXsbdbwOS2Ukm0Py2zHA6TGDVxG1M7BerTPLYCGNMuEhL8dvMegWZDbVcCfxrLTIl/smTTMfMz88/2QMMlIILENFn2HGxn6n9KGFGSM9fnvIuoSltt+BFYaxKdxjF02vM4/Ea6ZJ4PZhU1wGmedxoqoJYKgJYnrMmvhZEUyAhTP3w/ikPhmucA3OZkMJbxOvephxZSuMtQw==

Nov 4 10:18:35 ud kresd[1116]: [ 3792][iter] <= rcode: NOERROR

Nov 4 10:18:35 ud kresd[1116]: [ 3792][vldr] <= parent: updating DNSKEY

Nov 4 10:18:35 ud kresd[1116]: [ 3792][vldr] <= answer valid, OK

Nov 4 10:18:35 ud kresd[1116]: [44282][iter] 'silver.klfree.czf.' type 'A' id was assigned, parent id 0

Nov 4 10:18:35 ud kresd[1116]: [44282][plan] plan 'czf.' type 'DS'

Nov 4 10:18:35 ud kresd[1116]: [20288][iter] 'czf.' type 'DS' id was assigned, parent id 44282

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => trying zone: ., NSEC, hash 0

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => NSEC sname: range search found stale or insecure entry

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => skipping zone: ., NSEC, hash 0;new TTL -123456789, ret -2

Nov 4 10:18:35 ud kresd[1116]: [20288][resl] => querying: '10.102.0.252' score: 950 zone cut: '.' qname: 'CzF.' qtype: 'DS' proto: 'udp'

Nov 4 10:18:35 ud kresd[1116]: [20288][iter] <= answer received:

Nov 4 10:18:35 ud kresd[1116]: ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 20288

Nov 4 10:18:35 ud kresd[1116]: ;; Flags: qr rd ra cd QUERY: 1; ANSWER: 0; AUTHORITY: 6; ADDITIONAL: 1

Nov 4 10:18:35 ud kresd[1116]: ;; EDNS PSEUDOSECTION:

Nov 4 10:18:35 ud kresd[1116]: ;; Version: 0; flags: do; UDP size: 4096 B; ext-rcode: Unused

Nov 4 10:18:35 ud kresd[1116]: ;; QUESTION SECTION

Nov 4 10:18:35 ud kresd[1116]: czf.#011#011DS

Nov 4 10:18:35 ud kresd[1116]: ;; AUTHORITY SECTION

Nov 4 10:18:35 ud kresd[1116]: . #01110800#011SOA#011a.root-servers.net. nstld.verisign-grs.com. 2018110400 1800 900 604800 86400

Nov 4 10:18:35 ud kresd[1116]: . #01186400#011RRSIG#011SOA 8 0 86400 20181117050000 20181104040000 2134 . iQi+seZJvQJOnE7ZSex65TYVFtbJv8bxHa2zP5HPG/gD68E+YVvGQjivLs0/Sndyv2WrDZMtMbl+kio3gXLcDYu9Q7nMnFZo1bxs2Qzg6nudd0ZrOLk/SVVIV4EDYNZbI3uMwoQnGTEJwHjdLscfERPUOGhA8IKMTmZ05SNLuaeaIpaAdj7fRG84WFtOuD1r1GPsbe9r5MdaejP9ukr6E+AtSIljW092SjSGkbm9s56n28oAdd2gAdpuHiE5v7WBBKE0qsewHB4LPphoixO0V1Gj+TMowt3utLwSs5FpyN8tghblH5Lpwdtldygf1mmed1xfVli6tKsvP9oBzHb2Cw==

Nov 4 10:18:35 ud kresd[1116]: . #01186400#011RRSIG#011NSEC 8 0 86400 20181117050000 20181104040000 2134 . AOYErSSZk1NpSBQRdGYAxOVdgKkoxFSqx/sRZznbpavIt2XOa7TtyKh/oJtSd54qvW7psypOeSzEzuRGQwgxrQsNp9k8UFL+ZCg2GFZcgRsqooFNTlHl4dY7ZJvnvv7auoanAiDTwMlW0neCk5WY6j8c0xua6wjWjmm5zDTNOR8QI1jYyw9SJ+/7sGju5zObsajIxzen11c+JvqlpEGMtEOwmRWWD0aTUc8vTgnMO33cFuiCydcNyMQvcebSRiuHoZzLchL7JZzo95IbcQZa9n2cECK794HeZQhyPksq1YHbQdedGYkQMFuaDUnONPmr1jUDuSJjT5jE1aFeeFTL+A==

Nov 4 10:18:35 ud kresd[1116]: . #01110800#011NSEC#011aaa. NS SOA RRSIG NSEC DNSKEY

Nov 4 10:18:35 ud kresd[1116]: cz. #01186400#011RRSIG#011NSEC 8 1 86400 20181117050000 20181104040000 2134 . UCWO9+QhyKF0STm9hjG1oxCZCPQj/mgI6dvyfZaaEjMkQ/1RKu28UbdZnE4m6jhq+fd30ukbfNl24PA06f/eKFpxZu13S0cfqwjBkBLR8lECB3ko3nLQ2WA8EvSZ9SHvfrrrTqlo1dUrszswlcZZGaAWwyihmvnabgmvS4W+OroEl+c+0gpe52C2BO2JSHWX5HFWLkjcOhE6XPfz4XiRWZ0CIOzg3FmYexb+9VxcRG81kzFk0AMW8X7m8waVDpXY8GnH4wNixJAsYr5WbjU5lZzsOBdnH7bWr090UJoatKr4Tpn2+sZx/nfYqpe0M2KXIn6DknitsB6GkJhGFAA5ew==

Nov 4 10:18:35 ud kresd[1116]: cz. #01110800#011NSEC#011dabur. NS DS RRSIG NSEC

Nov 4 10:18:35 ud kresd[1116]: [20288][iter] <= rcode: NXDOMAIN

Nov 4 10:18:35 ud kresd[1116]: [20288][vldr] <= parent: updating DS

Nov 4 10:18:35 ud kresd[1116]: [20288][vldr] <= answer valid, OK

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => stashed cz. NSEC, rank 060, 310 B total, incl. 1 RRSIGs

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => stashed . NSEC, rank 060, 308 B total, incl. 1 RRSIGs

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => stashed . SOA, rank 060, 358 B total, incl. 1 RRSIGs

Nov 4 10:18:35 ud kresd[1116]: [20288][cach] => nsec_p stash for . skipped (extra TTL: 1993, hash: 0)

Nov 4 10:18:35 ud kresd[1116]: [20288][resl] <= server: '10.102.0.252' rtt: 4 ms

Nov 4 10:18:35 ud kresd[1116]: [55658][iter] 'silver.klfree.czf.' type 'A' id was assigned, parent id 0

Nov 4 10:18:35 ud kresd[1116]: [55658][resl] => querying: '10.102.0.252' score: 950 zone cut: '.' qname: 'sIlvEr.klfREE.czF.' qtype: 'A' proto: 'udp'

Nov 4 10:18:35 ud kresd[1116]: [55658][iter] <= answer received:

Nov 4 10:18:35 ud kresd[1116]: ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 55658

Nov 4 10:18:35 ud kresd[1116]: ;; Flags: qr aa rd ra cd QUERY: 1; ANSWER: 1; AUTHORITY: 2; ADDITIONAL: 3

Nov 4 10:18:35 ud kresd[1116]: ;; EDNS PSEUDOSECTION:

Nov 4 10:18:35 ud kresd[1116]: ;; Version: 0; flags: do; UDP size: 4096 B; ext-rcode: Unused

Nov 4 10:18:35 ud kresd[1116]: ;; QUESTION SECTION

Nov 4 10:18:35 ud kresd[1116]: silver.klfree.czf.#011#011A

Nov 4 10:18:35 ud kresd[1116]: ;; ANSWER SECTION

Nov 4 10:18:35 ud kresd[1116]: silver.klfree.czf. #01114400#011A#01110.102.25.1

Nov 4 10:18:35 ud kresd[1116]: ;; AUTHORITY SECTION

Nov 4 10:18:35 ud kresd[1116]: klfree.czf. #01114400#011NS#011ns1.klfree.czf.

Nov 4 10:18:35 ud kresd[1116]: klfree.czf. #01114400#011NS#011ns2.klfree.czf.

Nov 4 10:18:35 ud kresd[1116]: ;; ADDITIONAL SECTION

Nov 4 10:18:35 ud kresd[1116]: ns1.klfree.czf. #01114400#011A#01110.102.0.254

Nov 4 10:18:35 ud kresd[1116]: ns2.klfree.czf. #01114400#011A#01110.102.0.253

Nov 4 10:18:35 ud kresd[1116]: [55658][iter] <= rcode: NOERROR

Nov 4 10:18:35 ud kresd[1116]: [55658][plan] plan 'silver.klfree.czf.' type 'DS'

Nov 4 10:18:35 ud kresd[1116]: [55658][resl] <= server: '10.102.0.252' rtt: 2 ms

Nov 4 10:18:35 ud kresd[1116]: [15423][iter] 'silver.klfree.czf.' type 'DS' id was assigned, parent id 55658

Nov 4 10:18:35 ud kresd[1116]: [15423][cach] => trying zone: ., NSEC, hash 0

Nov 4 10:18:35 ud kresd[1116]: [15423][cach] => NSEC sname: covered by: cz. -> dabur., new TTL 10800

Nov 4 10:18:35 ud kresd[1116]: [15423][cach] => NSEC wildcard: covered by: . -> aaa., new TTL 10800

Nov 4 10:18:35 ud kresd[1116]: [15423][cach] => writing RRsets: +++

Nov 4 10:18:35 ud kresd[1116]: [15423][iter] <= answer received:

Nov 4 10:18:35 ud kresd[1116]: ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 15423

Nov 4 10:18:35 ud kresd[1116]: ;; Flags: qr aa QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0

Nov 4 10:18:35 ud kresd[1116]: ;; QUESTION SECTION

Nov 4 10:18:35 ud kresd[1116]: silver.klfree.czf.#011#011DS

Nov 4 10:18:35 ud kresd[1116]: ;; AUTHORITY SECTION

Nov 4 10:18:35 ud kresd[1116]: . #01110800#011SOA#011a.root-servers.net. nstld.verisign-grs.com. 2018110400 1800 900 604800 86400

Nov 4 10:18:35 ud kresd[1116]: cz. #01110800#011NSEC#011dabur. NS DS RRSIG NSEC

Nov 4 10:18:35 ud kresd[1116]: . #01110800#011NSEC#011aaa. NS SOA RRSIG NSEC DNSKEY

Nov 4 10:18:35 ud kresd[1116]: [15423][iter] <= rcode: NXDOMAIN

Nov 4 10:18:35 ud kresd[1116]: [15423][vldr] <= parent: updating DS

Nov 4 10:18:35 ud kresd[1116]: [15423][vldr] <= answer valid, OK

Nov 4 10:18:35 ud kresd[1116]: [55658][resl] => resuming yielded answer

Nov 4 10:18:35 ud kresd[1116]: [55658][vldr] >< failed to validate but skipping: klfree.czf. NS

Nov 4 10:18:35 ud kresd[1116]: [55658][vldr] >< no valid RRSIGs found for silver.klfree.czf. A

Nov 4 10:18:35 ud kresd[1116]: [55658][plan] plan 'silver.klfree.czf.' type 'RRSIG'

Nov 4 10:18:35 ud kresd[1116]: [ 4279][iter] 'silver.klfree.czf.' type 'RRSIG' id was assigned, parent id 55658

Nov 4 10:18:35 ud kresd[1116]: [ 4279][cach] => skipping RR type RRSIG

Nov 4 10:18:35 ud kresd[1116]: [ 4279][resl] => querying: '10.102.0.252' score: 950 zone cut: '.' qname: 'silvER.kLFreE.cZF.' qtype: 'RRSIG' proto: 'udp'

Nov 4 10:18:35 ud kresd[1116]: [ 4279][iter] <= answer received:

Nov 4 10:18:35 ud kresd[1116]: ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 4279

Nov 4 10:18:35 ud kresd[1116]: ;; Flags: qr aa rd ra cd QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 1

Nov 4 10:18:35 ud kresd[1116]: ;; EDNS PSEUDOSECTION:

Nov 4 10:18:35 ud kresd[1116]: ;; Version: 0; flags: do; UDP size: 4096 B; ext-rcode: Unused

Nov 4 10:18:35 ud kresd[1116]: ;; QUESTION SECTION

Nov 4 10:18:35 ud kresd[1116]: silver.klfree.czf.#011#011RRSIG

Nov 4 10:18:35 ud kresd[1116]: ;; AUTHORITY SECTION

Nov 4 10:18:35 ud kresd[1116]: klfree.czf. #01114400#011SOA#011ns1.klfree.czf. root.klfree.czf. 1541314442 10800 3600 604800 86400

Nov 4 10:18:35 ud kresd[1116]: [ 4279][iter] <= rcode: NOERROR

Nov 4 10:18:35 ud kresd[1116]: [ 4279][resl] <= server: '10.102.0.252' rtt: 3 ms

Nov 4 10:18:35 ud kresd[1116]: [ 4279][resl] => resuming yielded answer

Nov 4 10:18:35 ud kresd[1116]: [ 4279][vldr] <= bad NODATA proof

Nov 4 10:18:35 ud kresd[1116]: [ 4279][cach] => skipping RR type RRSIG

Nov 4 10:18:35 ud kresd[1116]: [ 4279][resl] finished: 0, queries: 3, mempool: 82000 B

Sincerely
Ivo Panacek