Re: Naked domain resolution with DNSSEC
Sourav Sain <[email protected]>
| Newsgroups | gmane.ietf.dnsext |
|---|---|
| Message-ID | <F04702D34F7A2740A330302703120864384C8916@SINEX14MBXC421.southpacific.corp.microsoft.com> |
Hi Dave Presented below is a name resolution for "facebook.com, type=A". In the first name resolution against "218.248.240.179" we see that "69.171.239.12#53(a.ns.facebook.com)" ends up returning an A record for QName=facebook.com. Since COM is signed A record for facebook.com needs to have an RRSIG(A) in the response, which, obviously is missing as a.ns.facebook.com cannot return the signature for A using keys owned by COM. Our concern is, a security aware validating server, having root or COM's Trust Anchor, will expect an RRSIG in the response for facebook.com, type=A, not having which, will conclude the response as BOGUS. Regarding resolvers which lets the response PASS but with AD bit unset, please see the 2nd and 3rd name resolutions. In the 2nd name resolution, I have tried to resolve "QName=COM, QType=DS" and I can see that 8.8.8.8 responds with "flags: qr rd ra ad; Hence the response is Authenticated Data. But in the third name resolution for facebook.com, type=A, asking 8.8.8.8 for validated responses, we do get the response but without "ad" in flags. Shouldn't there be a Serv Fail in this case (third name resolution for "facebook.com, type=A")? ---------------------------------------------------------------------------------------------------------- c:\dig\dig-files3>.\dig @218.248.240.179 facebook.com A +trace +dnssec ; <<>> DiG 9.3.2 <<>> @218.248.240.179 facebook.com A +trace +dnssec ; (1 server found) ;; global options: printcmd . 438113 IN NS j.root-servers.net. . 438113 IN NS f.root-servers.net. . 438113 IN NS c.root-servers.net. . 438113 IN NS a.root-servers.net. . 438113 IN NS m.root-servers.net. . 438113 IN NS l.root-servers.net. . 438113 IN NS i.root-servers.net. . 438113 IN NS d.root-servers.net. . 438113 IN NS h.root-servers.net. . 438113 IN NS g.root-servers.net. . 438113 IN NS k.root-servers.net. . 438113 IN NS b.root-servers.net. . 438113 IN NS e.root-servers.net. . 438113 IN RRSIG NS 8 0 518400 20131010000000 20131002230000 59085 . J77jB7Y61aBLsNMii8XphtUr1OwjIlzgwVz2W7FFzf1Yh0gKp1vyJ7G6 j9 MY3r/1TKEvOup6t/4Gnp4U32P8JP9FS6CzyoJYKOWCE8vSMekgcAr 4zwiBHfhhYndIJKJGpqpaF0GwnubiEREyXG7c5n53CCMjRh6ZB5/2FN0 V7E= ;; Received 857 bytes from 218.248.240.179#53(218.248.240.179) in 172 ms com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766 com. 86400 IN RRSIG DS 8 1 86400 20131013000000 20131005230000 59085 . BWF4iHvXMlOSY8AAhufgQuBOqt2kM7KRC5fnUJ14el+t75BKfas67coq luq MPJFiXb1ON6SidUE+asWVnVFcRU0FU+503+A/bhSvRcvtncKTSAA LOCd/68q6nvw1+mG3P3IDJVxDDEfBS3gpSctqZ73S1Y9dpSLhzjqhuY6 KYM= ;; Received 736 bytes from 192.58.128.30#53(j.root-servers.net) in 172 ms facebook.com. 172800 IN NS a.ns.facebook.com. facebook.com. 172800 IN NS b.ns.facebook.com. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN TYPE50 \# 35 0101000000146501B7E9587710CEFEFFBC49036905BE34AD22490007 22000000000290 CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG TYPE50 8 2 86400 20131013044124 20131006033124 8795 com. H3vUWw6JkfKMP0xebYmX3dZBrsFWew3z46qhsGw04P+xTexV/ vlHu2e g8w3WUiPMmE8tf+BZsPp3ssV3Ptoybv1h6atVFmbndBg1KxEpBpEM3ui HbEXeC+tR9foRz9A7LnsTerG7OdEloyRKgHxRN+OkX4DLy3Q8tgj1XWl Fhs= I287JBU8MGU307S65H71L34A9JJD947E.com. 86400 IN TYPE50 \# 34 010100000014909129C805FD2BEE60532B8E319B6CDC0D7AF5660006 200000000012 I287JBU8MGU307S65H71L34A9JJD947E.com. 86400 IN RRSIG TYPE50 8 2 86400 20131013043923 20131006032923 8795 com. hOj0Qr4RA/BmXNPO0qQsLkg5GFHW8UrLdXctCNFRgwYO9wK7O aSSBmm Zk4SKjqr8gWosPtwHJYKgSzuXacCUHIv/g8LOz3MliRstmMtJwWR2KXG GHk89e8EDO4Hd1BjZsqiArXYmq3PZ1gyQjO6omHP1AtGbdJgTI8qC2+Z fWk= ;; Received 593 bytes from 192.12.94.30#53(e.gtld-servers.net) in 406 ms facebook.com. 900 IN A 173.252.110.27 facebook.com. 172800 IN NS a.ns.facebook.com. facebook.com. 172800 IN NS b.ns.facebook.com. ;; Received 124 bytes from 69.171.239.12#53(a.ns.facebook.com) in 641 ms ---------------------------------------------------------------------------------------------------------- c:\dig\dig-files3>.\dig @8.8.8.8 COM DS +dnssec ; <<>> DiG 9.3.2 <<>> @8.8.8.8 COM DS +dnssec ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 932 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;COM. IN DS ;; ANSWER SECTION: COM. 19029 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766 COM. 19029 IN RRSIG DS 8 1 86400 20131013000000 20131005230000 59085 . BWF4iHvXMlOSY8AAhufgQuBOqt2kM7KRC5fnUJ14el+t75BKfas67coq luqB MPJFiXb1ON6SidUE+asWVnVFcRU0FU+503+A/bhSvRcvtncKTSAA LOCd/68q6nvw1+mG3P3IDJVxDDEfBS3gpSctqZ73S1Y9dpSLhzjqhuY6 KYM= ;; Query time: 187 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sun Oct 06 19:58:11 2013 ;; MSG SIZE rcvd: 239 ---------------------------------------------------------------------------------------------------------- c:\dig\dig-files3>.\dig @8.8.8.8 facebook.com A +dnssec ; <<>> DiG 9.3.2 <<>> @8.8.8.8 facebook.com A +dnssec ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 367 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;facebook.com. IN A ;; ANSWER SECTION: facebook.com. 834 IN A 173.252.110.27 ;; Query time: 406 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sun Oct 06 19:58:26 2013 ;; MSG SIZE rcvd: 57 -----Original Message----- From: Dave Lawrence [mailto:[email protected]] Sent: 03 October 2013 22:20 To: Kumar Ashutosh Cc: [email protected] Group; Sourav Sain Subject: Re: [dnsext] Naked domain resolution with DNSSEC Kumar Ashutosh writes: > The resolver was expecting a signed response for everything under COM, > gets an unsigned response and marks them as BOGUS and returns a > SERV_FAIL Some resolvers, do let the response pass but with AD bit set > to 0 which a DNSSEC aware end client may not accept. You've observed these behaviours? With which nameservers? _______________________________________________ dnsext mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsext