IETF Logo Mail Archive

Re: [DNSOP] How Slack didn't turn on DNSSEC

Mark Andrews <marka@isc.org> Wed, 01 December 2021 08:36 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 390353A0803 for <dnsop@ietfa.amsl.com>; Wed, 1 Dec 2021 00:36:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isc.org header.b=TXkuphlT; dkim=pass (1024-bit key) header.d=isc.org header.b=bG3aJH7W
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bagu5l4766Gc for <dnsop@ietfa.amsl.com>; Wed, 1 Dec 2021 00:35:58 -0800 (PST)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [IPv6:2001:4f8:0:2::2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E495C3A0801 for <dnsop@ietf.org>; Wed, 1 Dec 2021 00:35:58 -0800 (PST)
Received: from zimbrang.isc.org (zimbrang.isc.org [149.20.1.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx.pao1.isc.org (Postfix) with ESMTPS id D4F88433F01; Wed, 1 Dec 2021 08:35:55 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=isc.org; s=ostpay; t=1638347755; bh=r0YraFwfAKVHkEiVpiwGfdD9UX5KFQk6HuCsHixHzMk=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=TXkuphlTI1mJVDlJjLI8njDxhLMNL8MEgvZPBaoa3H5rf9RixxlkXDqLb4Bke6iBk 9wGRICvSVdwBR9WJCsVa4lZKYn2Gb8CVSjTYIVydehs998I6Qnm7osvnn2xLpBnIvu RZ0utlSVnequyvyGO9rcY+LeaDbBeTdBBMj7XD1g=
Received: from zimbrang.isc.org (localhost.localdomain [127.0.0.1]) by zimbrang.isc.org (Postfix) with ESMTPS id C2A32F255E1; Wed, 1 Dec 2021 08:35:55 +0000 (UTC)
Received: from localhost (localhost.localdomain [127.0.0.1]) by zimbrang.isc.org (Postfix) with ESMTP id 97C9EF255E3; Wed, 1 Dec 2021 08:35:55 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.10.3 zimbrang.isc.org 97C9EF255E3
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isc.org; s=05DFB016-56A2-11EB-AEC0-15368D323330; t=1638347755; bh=gK3OCsIQkTRfzk5HTnK4DqS4VW+qXZP0bYSLjZ9LylQ=; h=From:Mime-Version:Date:Message-Id:To; b=bG3aJH7WYe/ylT6aWtKICq9qaMu/X59zgkENj5yYYnnQGVYs6qNvbZNasLRr9gDvW r96oXlOW1pxUO8N5H0TZ0AXvANu1yS+g3dHevtGK5BP/CIfKAFnHEo5R3Izww2tGem Ppvg1xpJSdYcREs1p6I4SSF+Oh8vTNnY01Nm9J+g=
Received: from zimbrang.isc.org ([127.0.0.1]) by localhost (zimbrang.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Eu2VyzaH6DyA; Wed, 1 Dec 2021 08:35:55 +0000 (UTC)
Received: from smtpclient.apple (unknown [120.18.54.54]) by zimbrang.isc.org (Postfix) with ESMTPSA id 33A6BF255E1; Wed, 1 Dec 2021 08:35:55 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Mark Andrews <marka@isc.org>
Mime-Version: 1.0 (1.0)
Date: Wed, 01 Dec 2021 19:35:52 +1100
Message-Id: <C3D5AC3A-CA5A-4F33-8BDA-DDFADD23649C@isc.org>
References: <m1msK9b-0000HrC@stereo.hq.phicoh.net>
Cc: dnsop@ietf.org, John Levine <johnl@taugh.com>
In-Reply-To: <m1msK9b-0000HrC@stereo.hq.phicoh.net>
To: Philip Homburg <pch-dnsop-4@u-1.phicoh.com>
X-Mailer: iPhone Mail (19B74)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/DlN-gOdzk2Mk5W8JI00E724NqtY>
Subject: Re: [DNSOP] How Slack didn't turn on DNSSEC
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Dec 2021 08:36:04 -0000

Also stop hiding this breakage. Knot and unbound ignore the NSEC records which trigger this when synthesising.  All it does is push the problem down the road and makes it harder for others to do proper synthesis based on the records returned. 

-- 
Mark Andrews

> On 1 Dec 2021, at 18:36, Philip Homburg <pch-dnsop-4@u-1.phicoh.com> wrote:
> 
> 
>> 
>> It is clear from the blog post that this is a fairly sophisticated
>> group of ops people, who had a reasonable test plan, a bunch of test
>> points set up in dnsviz and so forth.  Neither of these bugs seem
>> very exotic, and could have been caught by routine tests.
> 
> It not clear to whether or not they did ZSK and KSK key rollovers
> on test zones and on minor zones. If they didn't, thats a good way to
> get in trouble later on.
> 
> The main lesson learned from this incident seems to be to always create
> a test zone with content identical to that of the main zone and fully
> test that zone.
> 
> A common lesson, also not mentioned, is to have low TTLs for stuff you
> control. It would not have helped with the DS record. But the discussion
> about the ZSK being lost would have been helped with a low TTL in the DNSKEY
> RR set.
> 
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

v2.23.0 | Report a Bug | By Email