[DNSOP] Fwd: Why is ns.coccaregistry.org returning REFUSED to DNSKEY queries?

Mark Andrews <marka@isc.org> Wed, 21 August 2019 23:51 UTC

From: Mark Andrews <marka@isc.org>
Content-Type: multipart/alternative; boundary="Apple-Mail=_02E73B8B-A7E4-49BF-B51C-EFE4B6EB57C9"
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Date: Thu, 22 Aug 2019 09:51:12 +1000
References: <4CB77A5E-2B63-4B7E-9B22-EA596C14B3BC@isc.org>
Cc: registry@nic.af, loyley.ngira@telekom.com.sb, royderitz.tati@telekom.com.sb, cctld@anc.tl, noc@cocca.org.nz
To: dnsop <dnsop@ietf.org>, dns-operations <dns-operations@dns-oarc.net>
Message-Id: <7C957602-0B99-4DBE-860C-7587A706732F@isc.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/lMXYIeymCx7y9qSu0NZw-lSZvZ8>
Subject: [DNSOP] Fwd: Why is ns.coccaregistry.org returning REFUSED to DNSKEY queries?
Precedence: list

ns.coccaregistry.org <http://ns.coccaregistry.org/> is serving 3 DNSSEC signed ccTLDs (AF, SB, TL) yet it is incapable of returning
DNSKEY records for those TLDs.  This will break DNSSEC validation for every lookup in those ccTLD
if this server is the only one reachable by the DNS clients.  This has been going on since at least April 2019.

Mark

> Begin forwarded message:
> 
> From: Mark Andrews <marka@isc.org>
> Subject: Why is ns.coccaregistry.org returning REFUSED to DNSKEY queries?
> Date: 8 April 2019 at 2:16:28 pm AEST
> To: hostmaster@coccaregistry.org
> 
> Why is ns.coccaregistry.org returning REFUSED to DNSKEY queries?
> Also why is it echoing back EDNS options when returning REFUSED?
> Also why is AD=1 in the REFUSED response?
> Also why is AA=1 in the REFUSED response?
> 
> % dig dnskey af. @185.17.236.111
> 
> ; <<>> DiG 9.15.0-dev <<>> dnskey af. @185.17.236.111
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 16189
> ;; flags: qr aa rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> ;; WARNING: recursion requested but not available
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ; COOKIE: b1626ff99509b9bf (echoed)
> ;; QUESTION SECTION:
> ;af.				IN	DNSKEY
> 
> ;; Query time: 316 msec
> ;; SERVER: 185.17.236.111#53(185.17.236.111)
> ;; WHEN: Mon Apr 08 14:12:00 AEST 2019
> ;; MSG SIZE  rcvd: 43
> 
> %
> 
> af. @185.17.236.111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok,yes ednstcp=refused
> af. @2a03:dd40:3::111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok,yes ednstcp=refused
> kn. @185.17.236.111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok ednstcp=refused
> kn. @2a03:dd40:3::111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok ednstcp=refused
> ms. @185.17.236.111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok ednstcp=refused
> ms. @2a03:dd40:3::111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok ednstcp=refused
> sb. @185.17.236.111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok,yes ednstcp=refused
> sb. @2a03:dd40:3::111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok,yes ednstcp=refused
> tl. @185.17.236.111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok,yes ednstcp=refused
> tl. @2a03:dd40:3::111 (ns.coccaregistry.org.): dns=ok edns=ok edns1=ok edns@512=refused ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok signed=ok,yes ednstcp=refused
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742              INTERNET: marka@isc.org
> 

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org

[DNSOP] Fwd: Why is ns.coccaregistry.org returnin… Mark Andrews