Re: dnssec-analyzer.verisignlabs.com aaaa lookup fail

[Walter H. via bind-users]

# host dnssec-analyzer.verisignlabs.com
dnssec-analyzer.verisignlabs.com is an alias for 
dnssec-analyzer-gslb.verisignlabs.com.

dnssec-analyzer-gslb.verisignlabs.com has address 209.131.158.42


On 27.04.2024 01:35, Lee wrote:

dig dnssec-analyzer.verisignlabs.com 

gives me a SERVFAIL & this in the bind errors_log file:

$ grep dnssec-analyzer.verisignlabs.com named-errors.log | tail -1
26-Apr-2024 19:28:37.600 query-errors: info: client @0x7f384488e3c0
127.0.0.1#47121 (dnssec-analyzer.verisignlabs.com): query failed
(failure) for dnssec-analyzer.verisignlabs.com/IN/ at query.c:7471


Is that because of the insecure delegation shown at
   https://dnsviz.net/d/dnssec-analyzer.verisignlabs.com/dnssec/
and me having "dnssec-validation auto;" in named.conf?

Thanks
Lee

(still struggling to understand this stuff)






smime.p7s
Description: S/MIME Cryptographic Signature
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: dnssec-analyzer.verisignlabs.com aaaa lookup fail

[Lee]

On Sat, Apr 27, 2024 at 9:50 AM Walter H. via bind-users
 wrote:
>
> # host dnssec-analyzer.verisignlabs.com
> dnssec-analyzer.verisignlabs.com is an alias for
> dnssec-analyzer-gslb.verisignlabs.com.
> dnssec-analyzer-gslb.verisignlabs.com has address 209.131.158.42
>

Right, the IPv4 address lookup works.  Now try looking up the IPv6 address.

I get a status: SERVFAIL instead of a status: NOERROR

$ dig dnssec-analyzer.verisignlabs.com 

; <<>> DiG 9.16.48-Debian <<>> dnssec-analyzer.verisignlabs.com 
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 60491
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

Lee
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Question about resolver

[J Doe]

On 2024-04-26 16:28, Mark Andrews wrote:


DS records live in the parent zone and the RFC 1034 rules for serving zone 
break down when a grandparent zone and child zone are served by the same 
server.  This is corrected be the client by looking for intermediate NS records 
to find the hidden delegations then resuming the DS lookup.

Named was looking up theses NS records I.e. chasing the DS servers.   This can 
result in named finding delegation errors.  QNAME minimisation also exposes 
these errors as it also does NS queries.  Garbage in breakage out.


Hi Mark,

Ah, ok, I believe I've got it now - thanks for you explanation!

- J
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Question about resolver

[J Doe]

On 2024-04-26 16:45, Josh Kuo wrote:


In this particular case, isn't the resolver attempting to do a reverse
lookup of the IP address that's listed ?


You are right, I missed that this is a reverse-mapping zone. In that
case, run DNSSEC analyzer on the domain "180.96.34.in-addr.arpa" and
you'll see the problem. Reverse-mapping zones work the same as
forward-mapping zones, they also need to be delegated properly.

If you prefer a more visual output, try DNSViz:
https://dnsviz.net/d/180.96.34.in-addr.arpa/dnssec/



Hi Josh,

Ok, sounds good!

- J

--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: dnssec-analyzer.verisignlabs.com aaaa lookup fail

[Walter H. via bind-users]

On 27.04.2024 16:54, Lee wrote:

On Sat, Apr 27, 2024 at 9:50 AM Walter H. via bind-users
 wrote:

# host dnssec-analyzer.verisignlabs.com
dnssec-analyzer.verisignlabs.com is an alias for
dnssec-analyzer-gslb.verisignlabs.com.
dnssec-analyzer-gslb.verisignlabs.com has address 209.131.158.42


Right, the IPv4 address lookup works.  Now try looking up the IPv6 address.


if there was one it would be presented there

see here for full answer

# host one.one.one.one
one.one.one.one has address 1.1.1.1
one.one.one.one has address 1.0.0.1
one.one.one.one has IPv6 address 2606:4700:4700::1001
one.one.one.one has IPv6 address 2606:4700:4700::



I get a status: SERVFAIL instead of a status: NOERROR

$ dig dnssec-analyzer.verisignlabs.com 

; <<>> DiG 9.16.48-Debian <<>> dnssec-analyzer.verisignlabs.com 
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 60491
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

Lee


this can't be a matter of DNSSEC, as there are only signed whole zones 
and not just single DNS-records ...


would it be a problem with just this DNS zone, why are only problems 
getting the IPv6?





smime.p7s
Description: S/MIME Cryptographic Signature
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users