Re: [DNSOP] How Slack didn't turn on DNSSEC

Philip Homburg <> Wed, 08 December 2021 13:36 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 067593A080F for <>; Wed, 8 Dec 2021 05:36:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id RPBb4UlKskoi for <>; Wed, 8 Dec 2021 05:36:34 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 193603A080E for <>; Wed, 8 Dec 2021 05:36:32 -0800 (PST)
Received: from (localhost [::ffff:]) by with esmtp (TLS version=TLSv1.2 cipher=ECDHE-RSA-CHACHA20-POLY1305) (Smail #158) id m1mux7V-0000HOC; Wed, 8 Dec 2021 14:36:29 +0100
Message-Id: <>
From: Philip Homburg <>
References: <> <>
In-reply-to: Your message of "Wed, 1 Dec 2021 19:35:52 +1100 ." <>
Date: Wed, 08 Dec 2021 14:36:28 +0100
Archived-At: <>
Subject: Re: [DNSOP] How Slack didn't turn on DNSSEC
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 08 Dec 2021 13:36:36 -0000

> Also stop hiding this
> breakage. Knot and unbound ignore the NSEC records which trigger
> this when synthesising.  All it does is push the problem down the
> road and makes it harder for others to do proper synthesis based
> on the records returned.

I did some tests with unbound (version 1.13.1-1 on Debian Bullseye). 

For types other than 'A', the behavior is quite simple: if both
DNSSEC validation (auto-trust-anchor-file) and aggressive-nsec are enabled
then unbound will synthesize NODATA based on a cached NSEC record.
Both are off by default.

For A records the situation is more complex. If qname-minimisation is off,
then the same applies to A records. However if qname-minimisation is on (and
it is on the default) then unbound will internally generate A record
queries. So the A record will be cached before the NSEC record. 

So in the case of Slack, anybody who enabled both DNSSEC validation and
aggressive-nsec would probably not have seen a failure due to the
broken NSEC records because qname-minimisation is on by default.