Thanks for reporting. It is a bit weird but now if I test it against doh3005, it seems to have resolved. Can you confirm?

Not that we have any logs around queries but at least looking at the SERVFAILs in pdns-rec's journal, there seem to be no matches for this domain, which doesn't help much.

Indeed, works again for me. Is there something I could've done when it was broken that would've given you more info to work off of?

In T432720#12141578, @taavi wrote:

Indeed, works again for me. Is there something I could've done when it was broken that would've given you more info to work off of?

It's a good question that deserves more thought but here's what I do for now:

• see if you can connect to another host; you can query a Wikidough host directly as well, so you can do kdig +tls restricted.bastion.wmcloud.org @208.80.154.70 instead of the Wikidough anycast and see if that helps
• we don't have query logs in the dnsdist interface as we disabled them during compile-time, so the most you can do is to SSH to the Wikidough host that is giving you the error and tail the pdns-recursor logs to see if you get a reason for the SRVFAIL
• try another domain for the particular host, to rule out any domain-specific issues

Let me know your thoughts if any.

pdns-recursor on Wikidough hosts is running on port 53, so you can also do a local query to see if it is something with dnsdist, or pdns-rec. dig @127.0.0.1 <domain> should give you the result from pdns-rec and not dnsdist.