opnsense.org DNS debugging

[daemonhorn]

I have been having strange dns issues specifically with opnsense.org and nsX.sectigoweb.com delegated nameservers, and I wanted to share in case others were seeing similar results.  Since DNS is inherently transient due to TTL cache and delegation through root servers, I hope this issue resolves itself before long, but in case others have issues and end up here, here are my test results and symptoms.

Symptoms: 
1) Transient DNS lookup failures while checking for updates (pkg.opnsense.org)
2) DNS lookup failures attempting to browse to https://forum.opnsense.org in firefox
3) Nameservers hosted by sectigoweb seem to be misbehaving:
- delegation failure for ns1-ns4.sectigoweb.com https://intodns.com/opnsense.org
- Resolution failure:  https://dns.google/query?name=opnsense.org&rr_type=A&ecs=

Debugging:

• Cloudflare (1.1.1.1)
  
  Code Select Expand
  dig forum.opnsense.org @1.1.1.1

; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54821
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for opnsense.org.)
; EDE: 22 (No Reachable Authority): (at delegation opnsense.org.)
;; QUESTION SECTION:
;forum.opnsense.org.            IN      A

;; Query time: 16 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Wed Sep 02 22:26:37 UTC 2026
;; MSG SIZE  rcvd: 132
• Quad 9 (9.9.9.9)
  
  Code Select Expand
  dig forum.opnsense.org @9.9.9.9

; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34292
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;forum.opnsense.org.            IN      A

;; ANSWER SECTION:
forum.opnsense.org.     699     IN      A       89.149.225.137

;; Query time: 0 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Wed Sep 02 22:46:29 UTC 2026
;; MSG SIZE  rcvd: 63
• Google (8.8.8.8)
  
  Code Select Expand
  dig forum.opnsense.org @8.8.8.8

; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 55647
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; EDE: 22 (No Reachable Authority): (At delegation opnsense.org for forum.opnsense.org/a)
;; QUESTION SECTION:
;forum.opnsense.org.            IN      A

;; Query time: 20 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Wed Sep 02 22:47:12 UTC 2026
;; MSG SIZE  rcvd: 104