I have been having strange dns issues specifically with
opnsense.org and nsX.sectigoweb.com delegated nameservers, and I wanted to share in case others were seeing similar results. Since DNS is inherently transient due to TTL cache and delegation through root servers, I hope this issue resolves itself before long, but in case others have issues and end up here, here are my test results and symptoms.
Symptoms:
1) Transient DNS lookup failures while checking for updates (pkg.opnsense.org)
2) DNS lookup failures attempting to browse to https://forum.opnsense.org in firefox
3) Nameservers hosted by sectigoweb seem to be misbehaving:
- delegation failure for ns1-ns4.sectigoweb.com https://intodns.com/opnsense.org
- Resolution failure: https://dns.google/query?name=opnsense.org&rr_type=A&ecs=
Debugging:
- Cloudflare (1.1.1.1)
dig forum.opnsense.org @1.1.1.1
; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54821
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for opnsense.org.)
; EDE: 22 (No Reachable Authority): (at delegation opnsense.org.)
;; QUESTION SECTION:
;forum.opnsense.org. IN A
;; Query time: 16 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Wed Sep 02 22:26:37 UTC 2026
;; MSG SIZE rcvd: 132 - Quad 9 (9.9.9.9)
dig forum.opnsense.org @9.9.9.9
; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34292
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;forum.opnsense.org. IN A
;; ANSWER SECTION:
forum.opnsense.org. 699 IN A 89.149.225.137
;; Query time: 0 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Wed Sep 02 22:46:29 UTC 2026
;; MSG SIZE rcvd: 63 - Google (8.8.8.8)
dig forum.opnsense.org @8.8.8.8
; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 55647
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; EDE: 22 (No Reachable Authority): (At delegation opnsense.org for forum.opnsense.org/a)
;; QUESTION SECTION:
;forum.opnsense.org. IN A
;; Query time: 20 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Wed Sep 02 22:47:12 UTC 2026
;; MSG SIZE rcvd: 104