bind error (no valid RRSIG) resolving

问题现象:
[root@192-168-174-39 ~]# dig @192.168.184.11

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 <<>> @192.168.184.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20142
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;.                 IN      A

;; Query time: 28 msec
;; SERVER: 192.168.184.11#53(192.168.184.11)
;; WHEN: Thu Mar 10 14:47:57 CST 2016
;; MSG SIZE  rcvd: 42

日志查看:

Mar 10 14:47:57 192-168-174-42 named[15948]: error (no valid RRSIG) resolving 'com/DS/IN': 223.5.5.5#53
Mar 10 14:47:57 192-168-174-42 named[15948]: error (no valid RRSIG) resolving 'com/DS/IN': 114.114.114.114#53
Mar 10 14:47:57 192-168-174-42 named[15948]: error (no valid DS) resolving '/A/IN': 114.114.114.114#53
Mar 10 14:47:57 192-168-174-42 named[15948]: validating @0x7fdba0000dd0: A: bad cache hit (com/DS)
Mar 10 14:47:57 192-168-174-42 named[15948]: error (broken trust chain) resolving '/A/IN': 223.5.5.5#53



解决:
由于是局域网内非法DNS,所以将DNS安全关闭.
[root@192-168-174-42 ~]# vim /etc/named.conf
将下面的两项设置为no
        dnssec-enable no;
        dnssec-validation no;
[root@192-168-174-39 ~]# dig @192.168.184.11

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 <<>> @192.168.184.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3641
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;.                 IN      A

;; ANSWER SECTION:
.          30      IN      CNAME  
       249     IN      A       111.13.100.92
       249     IN      A       111.13.100.91

;; Query time: 18 msec
;; SERVER: 192.168.184.11#53(192.168.184.11)
;; WHEN: Thu Mar 10 14:49:43 CST 2016
;; MSG SIZE  rcvd: 101

[root@192-168-174-39 ~]#