Subject: Re: [DNSOP] Heads up: DANE TLSA lookup issues with some nameservers.

From: "DeJong, Steve" <[email-masked]>
Date: Wed, 25 Nov 2015 20:37:31 +0000

Greetings -
As of Nov. 22 Neustar UltraDNS has completed the rollout of the latest
resolver which addresses the NSEC3 authenticated denial of existence
issues.

Thanks to Viktor for assisting in the testing and verification of the fix.

-Steve

On 8/11/15, 10:20 PM, "DNSOP on behalf of Viktor Dukhovni"
<[email-masked] on behalf of [email-masked]> wrote:

>    * Outdated versions of PowerDNS, don't handle denial of
>      existence correctly, the query domain's immediate parent
>      also does not exist.  In particular queries of the form:
>
>	_25._tcp.example.com. IN TLSA ?
>
>      fail to elicit proof that "_tcp" does not exist (which is
>      typically the case).  The response is then "bogus", and mail
>      is delayed.
>
>      This currently afflicts various Neustar.biz nameservers, in
>      some cases appearing as nameservers for various customers.
>
>

---

From: Mark Andrews <[email-masked]>
Date: Thu, 26 Nov 2015 10:48:54 +1100

Testing for things like a successful resolution to _25._tcp.example.com.
IN TLSA is something registries / registrars should be doing.  If
you deploy servers that are incapable of answering the query then
that becomes potential grounds for removal of the delegation.

Whether you have or don't have a TLSA record is a entirely seperate
matter.

It is "can the server answer the question or not" that the parents
need to be concerned with.  www.example.com/AAAA, www.example.com/A,
example.com/MX, example.com/A and example.com/AAAA should all be
answerable and if there is a negative response that the SOA record
if present is consistent with the delegation.  A SOA for COM is not
a valid SOA record with some exceptions.

In message <[email-masked]>, "DeJong, Steve" writes:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]