Re: [DNSOP] New draft on delegation revalidation

[Shumon Huque <[e-mail]>]

On Tue, Apr 28, 2020 at 5:43 AM Giovane C. M. Moura <giovane.moura=
[e-mail]> wrote:

> Hi Shumon,
>
> >  Do you plan to maintain the parent/child disjoint NS
> > domain (marigliano.xyz <http://marigliano.xyz>) going forward? And what
> > about the test
> > domains for other types of misconfigurations?
>
> Great idea. Let me look into this, will get back to with that.
>

Thanks!


> > Did you look at the potential problem of members of the child (or
> > parent) NS sets emitting different information? I suspect that case
> > also happens.
>
> Yes, section 4 covers this (NSSet parent != NSSet child).
>
> We have 4 scenarios, and we always query for the A record of
> $probeid-$timestamp.marigliano.xyz
>
> The trick was to configure different NSes to return different A answers,
> so we knew which NS answer which query.
>
> Is that what you refer?
>

I meant servers within the child (or parent) NS set had different NS
sets configured in them, i.e. yet another level of mismatch. Maybe
that's not worth investigating, but I'm pretty sure I've come across
such misconfigurations in the past.

> Do you have any plans to look at the behavior of the large public
> > resolvers?
>
> That's a good idea, to answer this one, we need to configure the
> scenarios again. Let me get back to you once I manage to get this setup
> for other folks to test this too
>

Cool, thanks!

Shumon.