On Sun, Feb 28, 2021 at 2:44 AM Florian Weimer <[email protected]> wrote:
> * Winfried Angele: > > > I guess they've turned off validation for irs.gov because of a > > former failure. > > I think it goes beyond that. It extends to GOV and MIL as a whole, it > seems. > > Interesting. It didn't occur to me to check that. It appears you are correct. Their website should certainly document that they have such a huge exception in place for two major US gTLDs in their DNSSEC validation implementation. If it is documented somewhere, I couldn't find it. C:\>dig @9.9.9.9 gov. ns +dnssec +adflag ; <<>> DiG 9.12.1-P2 <<>> @9.9.9.9 gov. ns +dnssec +adflag ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49356 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;gov. IN NS ;; ANSWER SECTION: gov. 43200 IN NS a.gov-servers.net. gov. 43200 IN NS c.gov-servers.net. gov. 43200 IN NS b.gov-servers.net. gov. 43200 IN NS d.gov-servers.net. gov. 43200 IN RRSIG NS 8 1 172800 20210307111009 20210228111009 27306 gov. Hsn0bfePCVgL89MzbJLO+qWeVS8UyBhTsI8ZkiM0L3Bd4Ts94b5Lr+b6 1mmRBggNq60YNmNNr0T6pWYgiXvkHNFiMAkOWsWnBhF78bFhvZZzWUWU ajD3Jcwj9iYK2OiL+ee3Qk1U0iBIAcoAkB7xD8Ffk0wzzak3Ly/Q6M3s Y/cjCmsI5ts6KtCxZoE3vrqZVyRaqAVQdsyJDZx7HCsjig== ;; Query time: 57 msec ;; SERVER: 9.9.9.9#53(9.9.9.9) ;; WHEN: Sun Feb 28 06:39:33 Central Standard Time 2021 ;; MSG SIZE rcvd: 306 C:\>dig @9.9.9.9 mil. ns +dnssec +adflag ; <<>> DiG 9.12.1-P2 <<>> @9.9.9.9 mil. ns +dnssec +adflag ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7742 ;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 1232 ;; QUESTION SECTION: ;mil. IN NS ;; ANSWER SECTION: mil. 19475 IN NS CON2.NIPR.mil. mil. 19475 IN NS EUR1.NIPR.mil. mil. 19475 IN NS PAC1.NIPR.mil. mil. 19475 IN NS CON1.NIPR.mil. mil. 19475 IN NS PAC2.NIPR.mil. mil. 19475 IN NS EUR2.NIPR.mil. mil. 19475 IN RRSIG NS 8 1 21600 20210305172406 20210226172406 19128 mil. xgAGFEuR9fgkV3LFYwkVgES3PzZOJan/Rnxz3eK9UJIf87Hvr3b8/6G4 Wk8Bc+3amLOZYEt483hU3ONJKa+gY4Mb4i7jCc1otvyOxF0eCWMTLN6V 9ZBKK5sLJm5GSYblD+MWS5Ko6DiwbGhR6u4PatEzrXhUrLITiSjQjLJH 1rQ= ;; Query time: 59 msec ;; SERVER: 9.9.9.9#53(9.9.9.9) ;; WHEN: Sun Feb 28 06:39:43 Central Standard Time 2021 ;; MSG SIZE rcvd: 314
_______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations
