Subject: mailarchive: Bogus DNSSEC signature

From: Stefan Winter <[email-masked]>
Date: Thu, 21 Jul 2016 15:29:32 +0200

Hi,

see attached screenshot. Shouldn't we be doing better than this?

Greetings,

Stefan Winter

---

From: Paul Wouters <[email-masked]>
Date: Thu, 21 Jul 2016 10:53:43 -0400 (EDT)

> see attached screenshot. Shouldn't we be doing better than this?

Seems to have gotten resigned an hour and some ago.... Although I dont
like RRSIG's with a 1year replay window myself :/

mailarchive.ietf.org.	1793	IN	RRSIG	CNAME 5 3 1800 20170721141257 20160721131442 [...]

(it is now 201607211421 now)
Paul

---

From: Russ Housley <[email-masked]>
Date: Thu, 21 Jul 2016 13:16:17 -0400

None of these online tools are seeing a problem:

http://dnssec-debugger.verisignlabs.com/ietf.org
http://dnssec-debugger.verisignlabs.com/mailarchive.ietf.org
http://dnsviz.net/d/mailarchive.ietf.org/dnssec/

Russ

On Jul 21, 2016, at 9:29 AM, Stefan Winter <[email-masked]> wrote:

> <Bildschirmfoto 2016-07-21 um 11.53.01.png><0x8A39DC66.asc>