[dane] Problem with hosting2go.nl nameservers and DANE TLSA

[Viktor Dukhovni <[e-mail]>]

[ Cc: to the dane WG list, in the hope that some here might be
  able to assist, if they have direct contacts at the provider.
  Please don't Cc: any follow-up list discussion to the ISP contact
  address. ]

Many hosting2go.nl domains emit incorrect denial of existence NSEC
records for DANE TLSA queries.  This will cause email delivery
problems to your customers' domains if not resolved by fixing the
nameserver software.  My (surely incomplete) list of affected
domains is below.

For example, the nameservers for albertplatje.nl return NODATA
instead of NXDMAIN for the query below:

    $ dig +cd +dnssec -t tlsa _25._tcp.albertplatje.nl. +nocl +nottl |
	pcregrep 'status:|^;; flags|\.\s+NSEC'
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20796
    ;; flags: qr rd ra cd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
    *.albertplatje.nl.      NSEC    _autodiscover._tcp.albertplatje.nl. A RRSIG NSEC

The NSEC record proves the presence of "_tcp.albertplatje.nl", and
the absence of both "_25._tcp.albertplatje.nl" and "*._tcp.albertplatje.nl"
which lie between the NSEC pair endpoints.  Therefore, this record should
be an NXDOMAIN, not NOERROR (aka NODATA when the answer count is 0).

In this case I believe we have a bug in dnsviz, which fails to note
that NSEC the record proves the existence of the empty non-terminal
"_tcp", and thus the relevant closest encloser is "_tcp" and so
the wildcard RRset is out of scope, and hence the RCODE should be
NXDOMAIN.

    http://dnsviz.net/d/_25._tcp.albertplatje.nl/dnssec/?rr=52&ds=all&a=all&doe=on&ta=.

Queries for the TLSA records of all the MX hosts below similarly
fail validation.  What and when might be done to fully address this
issue?

Domain                             _25._tcp.mx-host. IN TLSA ?
---------------------------------  ---------------------------
albertplatje.nl.                   _25._tcp.albertplatje.nl. IN TLSA ?
azie4y.nl.                         _25._tcp.azie4y.nl. IN TLSA ?
delta-hardware.nl.                 _25._tcp.delta-hardware.nl. IN TLSA ?
digistrip.nl.                      _25._tcp.digistrip.nl. IN TLSA ?
edwords.nl.                        _25._tcp.edwords.nl. IN TLSA ?
flashpatterns.nl.                  _25._tcp.flashpatterns.nl. IN TLSA ?
informatieplatform.nl.             _25._tcp.informatieplatform.nl. IN TLSA ?
kenney.nl.                         _25._tcp.kenney.nl. IN TLSA ?
locdepot.nl.                       _25._tcp.locdepot.nl. IN TLSA ?
mc4e.nl.                           _25._tcp.mc4e.nl. IN TLSA ?
mega-save.nl.                      _25._tcp.mega-save.nl. IN TLSA ?
netspecialist.nl.                  _25._tcp.netspecialist.nl. IN TLSA ?
parfumsector.nl.                   _25._tcp.parfumsector.nl. IN TLSA ?
portraitsbyrhalda.nl.              _25._tcp.portraitsbyrhalda.nl. IN TLSA ?
premiumsecurity.nl.                _25._tcp.premiumsecurity.nl. IN TLSA ?
rijschoolnaz.nl.                   _25._tcp.rijschoolnaz.nl. IN TLSA ?
schaakzone.nl.                     _25._tcp.schaakzone.nl. IN TLSA ?
straxlive.nl.                      _25._tcp.straxlive.nl. IN TLSA ?
we12travel.nl.                     _25._tcp.we12travel.nl. IN TLSA ?
winkelsector.nl.                   _25._tcp.winkelsector.nl. IN TLSA ?

-- 
	Viktor.