Subject: ietf.org now DNSSEC-bogus :-(

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 27 Jun 2014 12:50:28 +0200

[Sent by using a mail server with a non-validating resolver...]

The delegation at .org still indicates the old name servers but the
zone contains the new ones, at Cloudflare.

% dig @ns0.amsl.com. NS ietf.org

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @ns0.amsl.com. NS ietf.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51586
;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;ietf.org.		IN NS

;; ANSWER SECTION:
ietf.org.		1800 IN	NS jack.ns.cloudflare.com.
ietf.org.		1800 IN	NS dora.ns.cloudflare.com.
ietf.org.		1800 IN	RRSIG NS 5 2 1800 20150627101542 (
				20140627091717 40452 ietf.org.
				cGLMaGJyWGuBsUJ43Ot5c1N8A0pe0DYpML2qhnCdvWAv
				SAiuyejFv0yjSXT2dAA4gM/lRMw6Ii07wus1S7GKAcS3
				df2Rr2ltVxl3NWvo7cKXVAQN59QL2Er2G0J71zEBwMZu
				dx6UznWSBWf9IrNvDn6VHZkUzKOxcExtnOgV9iwk3Pef
				UfJpvHelQXo4DgYI5a2wCpuLcljLfb62GYu/N4vLYOLB
				hGxyygvDnCriYSGFlVO7bhqA6bFbZWK/g8G26zEqE+ix
				+XjkiV9hBR1xSadgiqPi28sBAFy+zyvVrrkracgzFGzC
				5Jz2dAE+c6Haw8Es74sizo3VZ7M5tnKU+w== )

;; Query time: 75 msec
;; SERVER: 64.170.98.2#53(64.170.98.2)
;; WHEN: Fri Jun 27 12:46:31 2014
;; MSG SIZE  rcvd: 388

The cloudflare name servers does not server RRSIG or DNSKEY :-(

% dig @jack.ns.cloudflare.com. DNSKEY ietf.org

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @jack.ns.cloudflare.com. DNSKEY ietf.org
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29097
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;ietf.org.		IN DNSKEY

;; AUTHORITY SECTION:
ietf.org.		86400 IN SOA dora.ns.cloudflare.com. dns.cloudflare.com. (
				2015553176 ; serial
				10000      ; refresh (2 hours 46 minutes 40 seconds)
				2400       ; retry (40 minutes)
				604800     ; expire (1 week)
				3600       ; minimum (1 hour)
				)

;; Query time: 8 msec
;; SERVER: 2400:cb00:2049:1::adf5:3b79#53(2400:cb00:2049:1::adf5:3b79)
;; WHEN: Fri Jun 27 12:49:46 2014
;; MSG SIZE  rcvd: 99

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 27 Jun 2014 12:52:28 +0200

On Fri, Jun 27, 2014 at 12:50:28PM +0200,
 Stephane Bortzmeyer <[email-masked]> wrote 

> zone contains the new ones, at Cloudflare.

http://dnsviz.net/d/ietf.org/U61LsA/dnssec/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 27 Jun 2014 12:56:02 +0200

> zone contains the new ones, at Cloudflare.

Ticket [www.ietf.org/rt #66469] by the way.

---

From: Christopher Morrow <[email-masked]>
Date: Fri, 27 Jun 2014 10:51:20 -0400

;; QUESTION SECTION:
;ietf.org.                      IN      NS

;; ANSWER SECTION:
ietf.org.               1773    IN      NS      ns1.mia1.afilias-nst.info.
ietf.org.               1773    IN      NS      ns1.hkg1.afilias-nst.info.
ietf.org.               1773    IN      NS      ns1.yyz1.afilias-nst.info.
ietf.org.               1773    IN      NS      ns1.ams1.afilias-nst.info.
ietf.org.               1773    IN      NS      ns1.sea1.afilias-nst.info.
ietf.org.               1773    IN      NS      ns0.amsl.com.

maybe fixed now?

http://dnsviz.net/d/ietf.org/dnssec/

seems to also indicate fix action has taken place.

---

From: Shumon Huque <[email-masked]>
Date: Fri, 27 Jun 2014 10:57:29 -0400

There is still another problem that arguably needs to be addressed.

The IETF website (www.ietf.org) is now aliased to Cloudflare zones that
don't do DNSSEC. So
validating resolvers querying the IETF website, www.ietf.org will not be
able to authenticate the result. The AD bit won't be set because the answer
section includes A/AAAA records without signatures.

--Shumon.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 27 Jun 2014 18:22:24 +0200

On Fri, Jun 27, 2014 at 10:51:20AM -0400,
 Christopher Morrow <[email-masked]> wrote 

> maybe fixed now?

Yes, back to the correct name servers. See what happened during the problem:

http://dnsviz.net/d/ietf.org/U61S3A/dnssec/

---

From: Dick Franks <[email-masked]>
Date: Fri, 27 Jun 2014 18:09:38 +0100

Possibly an IPv6 routing issue here too.
Both nameservers affected, and have common address prefix, so it is all or
nothing.

cloudflare.net.    86259    IN    SOA    fred.ns.cloudflare.com.
dns.cloudflare.com. (
                    2014904817    ;serial
                    10000        ;refresh
                    2400        ;retry
                    604800        ;expire
                    3600    )    ;minimum
www.ietf.org.    1658    IN    RRSIG    CNAME 5 3 1800 (
    20150627140549 20140627130739 40452 ietf.org.
    Oggxi8gGJxwg0n+ ...
www.ietf.org.    1658    IN    CNAME    www.ietf.org.cdn.cloudflare.net.
----

[1]*    fred.ns.cloudflare.com  [173.245.59.113]
            zone serial    2014904817

[1]*    fred.ns.cloudflare.com  [2400:cb00:2049:1:0:0:adf5:3b71]
### no response

[2]    jean.ns.cloudflare.com  [173.245.58.121]
            zone serial    2014904817

[2]    jean.ns.cloudflare.com  [2400:cb00:2049:1:0:0:adf5:3a79]
### no response

Unsatisfactory response from 2 nameservers

________________________