Open Stack

Tom Fifield <tom at openstack.org> writes:

> Hello infra,
>
> Exploratory question here, no idea what's actually going on.
>
> We have a prospective new user on Ask OpenStack, who despite trying
> multiple auth methods (Launchpad & Google) multiple times did not
> receive a confirmation email.
>
> I checked and there have been several new users created within the
> same day, so it does not seem like a general email problem.
>
>
> May I ask if there is anything revealing in the logs around
> me at tiferrei.com ?

The MTA reports a DNS failure for that domain.  The problem appears to
be related to DNSSEC on that domain.  It looks like the domain
previously had invalid signing keys, but they have been removed.
However, DNS resolvers may still have those keys cached.  The caching
resolver that ask.o.o is using indicates it has a bit over 8 hours
remaining.  Google's public DNS servers indicate almost 24 hours
remaining in their cache.

Assuming the user's DNS configuration is and remains correct, the
problem should be corrected on ask.o.o within 9 hours, and they should
see other DNS related failures abate as they reach the original
expiration time of the erroneous DS records.

-Jim