<div dir="ltr">On Thu, Nov 14, 2013 at 11:19 AM, Marc Lampo <span dir="ltr"><<a href="mailto:marc.lampo.ietf@gmail.com" target="_blank">marc.lampo.ietf@gmail.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div><div><div><div><div><div>Hello,<br><br><a href="http://dnsstuff.com" target="_blank">dnsstuff.com</a> gives me all green for DNSSEC of <a href="http://uscg.mil" target="_blank">uscg.mil</a>.<br>
</div><a href="http://dnsviz.net" target="_blank">dnsviz.net</a> gives warnings (not : errors) on all RRSIG's - something with TTL values.<br>
<br></div>What is odd - but should not be fatal - is that <a href="http://uscg.mil" target="_blank">uscg.mil</a> authoritative name servers send replies with "strange" TTL values.<br>1) <a href="http://uscg.mil" target="_blank">uscg.mil</a>. 77481 IN MX 40 <a href="http://smtp-gateway-4.uscg.mil" target="_blank">smtp-gateway-4.uscg.mil</a>.<br>
2) <a href="http://uscg.mil" target="_blank">uscg.mil</a>. 77439 IN MX 40 <a href="http://smtp-gateway-4.uscg.mil" target="_blank">smtp-gateway-4.uscg.mil</a>.<br></div>--> TTL is decreasing for that RR<br>
</div> (strangely enough, TTL does not decrease for other RR's in the RRset, and consequently : different the one shown above)<br>
<br></div>Now the RRSIG over the MX RRset says the TTL in the zone file is 86400 :<br><a href="http://uscg.mil" target="_blank">uscg.mil</a>. 80850 IN RRSIG MX 7 2 86400 ...<br><br></div>Although weird :<br>
</div>1) TTL values of all RR's in the RRset should be identical<br>
</div>2) the authoritative name server partly behaves like it were replying from cache<br></div>these abnormalities should not be fatal, in my opinion.<br></div><br></div><div>I wonder what kind of name servers <a href="http://uscg.mil" target="_blank">uscg.mil</a> uses ?<br>
<br></div><div>Kind regards,<br><br></div></div></div><div class=""><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Nov 14, 2013 at 7:22 PM, Khuu, Linh Contractor <span dir="ltr"><<a href="mailto:Linh.Khuu@ssa.gov" target="_blank">Linh.Khuu@ssa.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div link="blue" vlink="purple" lang="EN-US"><div><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)">Hi Marc,<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)"><u></u> <u></u></span></i></p><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)">Yes, on my DNS server, if I do a dig @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a>, I got answer (with AD bit set). I also do a dig @<a href="http://pac1.nipr.mil" target="_blank">pac1.nipr.mil</a>, I got answer (with AA bit set).<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)"><u></u> <u></u></span></i></p><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)">However, when I do dig @localhost, that is where I don’t get any result at all.<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)"><u></u> <u></u></span></i></p><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)">All the DNSSEC tools out there, like <a href="http://dnsviz.net" target="_blank">dnsviz.net</a>, <a href="http://dnsstuff.com" target="_blank">dnsstuff.com</a>, <a href="http://dnscheck.iis.se" target="_blank">dnscheck.iis.se</a>, they all show DNSSEC error for <a href="http://uscg.mil" target="_blank">uscg.mil</a>.<u></u><u></u></span></i></p>
<div><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)"><u></u> <u></u></span></i></p><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:blue">Linh Khuu<br>
Network Security Specialist<br>Northrop Grumman IS | Civil Systems Division (CSD)<br>Office: <a href="tel:410-965-0746" value="+14109650746" target="_blank">410-965-0746</a><br>Pager: <a href="tel:443-847-7551" value="+14438477551" target="_blank">443-847-7551</a><br>
Email: <a href="mailto:Linh.Khuu@ssa.gov" target="_blank">Linh.Khuu@ssa.gov</a><u></u><u></u></span></i></p><p class="MsoNormal"><i><span style="font-family:"Georgia","serif";color:rgb(31,73,125)"><u></u> <u></u></span></i></p>
</div><p class="MsoNormal"><b><span style="font-size:10pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10pt;font-family:"Tahoma","sans-serif""> Marc Lampo [mailto:<a href="mailto:marc.lampo.ietf@gmail.com" target="_blank">marc.lampo.ietf@gmail.com</a>] <br>
<b>Sent:</b> Thursday, November 14, 2013 1:16 PM<br><b>To:</b> Khuu, Linh Contractor<br><b>Cc:</b> Bind Users Mailing List<br><b>Subject:</b> Re: Does anyone have DNSSEC problem with <a href="http://uscg.mil" target="_blank">uscg.mil</a><u></u><u></u></span></p>
<div><div><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal" style="margin-bottom:12pt">Not at this moment :<br>$ dig @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> mx <a href="http://uscg.mil" target="_blank">uscg.mil</a>. +dnssec<br>
<br>; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> mx <a href="http://uscg.mil" target="_blank">uscg.mil</a>. +dnssec<br>; (1 server found)<br>;; global options: +cmd<br>
;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42506<br>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags: do; udp: 512<br>
;; QUESTION SECTION:<br>;<a href="http://uscg.mil" target="_blank">uscg.mil</a>. IN MX<br><br>;; ANSWER SECTION:<br><a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 40 <a href="http://smtp-gateway-4.uscg.mil" target="_blank">smtp-gateway-4.uscg.mil</a>.<br>
<a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 40 <a href="http://smtp-gateway-4a.uscg.mil" target="_blank">smtp-gateway-4a.uscg.mil</a>.<br><a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 10 <a href="http://smtp-gateway-2.uscg.mil" target="_blank">smtp-gateway-2.uscg.mil</a>.<br>
<a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 20 <a href="http://smtp-gateway-5a.uscg.mil" target="_blank">smtp-gateway-5a.uscg.mil</a>.<br><a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 10 <a href="http://smtp-gateway-1.uscg.mil" target="_blank">smtp-gateway-1.uscg.mil</a>.<br>
<a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 20 <a href="http://smtp-gateway-5.uscg.mil" target="_blank">smtp-gateway-5.uscg.mil</a>.<br><a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 10 <a href="http://smtp-gateway-1a.uscg.mil" target="_blank">smtp-gateway-1a.uscg.mil</a>.<br>
<a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN MX 10 <a href="http://smtp-gateway-2a.uscg.mil" target="_blank">smtp-gateway-2a.uscg.mil</a>.<br><a href="http://uscg.mil" target="_blank">uscg.mil</a>. 8478 IN RRSIG MX 7 2 86400 20131118074336 20131113074105 53369 <a href="http://uscg.mil" target="_blank">uscg.mil</a>. F...<u></u><u></u></p>
</div><p class="MsoNormal" style="margin-bottom:12pt">Observe : AD bit set.<br><br>Kind regards,<u></u><u></u></p></div><div><p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p><div><p class="MsoNormal">
On Thu, Nov 14, 2013 at 7:00 PM, Khuu, Linh Contractor <<a href="mailto:Linh.Khuu@ssa.gov" target="_blank">Linh.Khuu@ssa.gov</a>> wrote:<u></u><u></u></p><p class="MsoNormal">Hi,<br><br>Does anyone have any DNSSEC problem with <a href="http://uscg.mil" target="_blank">uscg.mil</a>.<br>
<br>On our DNS servers, we have seen broken trust chain error and the validation failed.<br><br>14-Nov-2013 12:57:37.486 lame-servers: error (broken trust chain) resolving '<a href="http://uscg.mil/A/IN" target="_blank">uscg.mil/A/IN</a>': 199.211.218.6#53<br>
14-Nov-2013 12:57:37.573 lame-servers: error (broken trust chain) resolving '<a href="http://uscg.mil/A/IN" target="_blank">uscg.mil/A/IN</a>': 199.211.218.6#53<br>14-Nov-2013 12:57:37.658 lame-servers: error (broken trust chain) resolving '<a href="http://uscg.mil/MX/IN" target="_blank">uscg.mil/MX/IN</a>': 199.211.218.6#53<br>
14-Nov-2013 12:57:37.743 lame-servers: error (broken trust chain) resolving '<a href="http://uscg.mil/MX/IN" target="_blank">uscg.mil/MX/IN</a>': 199.211.218.6#53<br><br>14-Nov-2013 12:58:12.878 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> AAAA: in authvalidated<br>
14-Nov-2013 12:58:12.878 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> AAAA: authvalidated: got broken trust chain<br>14-Nov-2013 12:58:12.878 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> AAAA: resuming nsecvalidate<br>
14-Nov-2013 12:58:13.058 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> A: starting<br>14-Nov-2013 12:58:13.058 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> A: attempting positive response validation<br>
14-Nov-2013 12:58:13.058 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> A: in fetch_callback_validator<br>14-Nov-2013 12:58:13.058 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> A: fetch_callback_validator: got failure<br>
14-Nov-2013 12:58:13.233 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> MX: starting<br>14-Nov-2013 12:58:13.233 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> MX: attempting positive response validation<br>
14-Nov-2013 12:58:13.233 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> MX: in fetch_callback_validator<br>14-Nov-2013 12:58:13.233 dnssec: debug 3: validating @23cee638: <a href="http://uscg.mil" target="_blank">uscg.mil</a> MX: fetch_callback_validator: got failure<br>
<br>Thanks,<br>Linh Khuu<br>Network Security Specialist<br>Northrop Grumman IS | Civil Systems Division (CSD)<br>Office: <a href="tel:410-965-0746" target="_blank">410-965-0746</a><br>Pager: <a href="tel:443-847-7551" target="_blank">443-847-7551</a><br>
Email: <a href="mailto:Linh.Khuu@ssa.gov" target="_blank">Linh.Khuu@ssa.gov</a><br><br></p></div></div></div></div></div></div></blockquote></div></div></div></div></blockquote></div><br clear="all">Don't forget that Google will white-list domains with known (by them) broken DNSSEC and
reply even though validation is broken, so using 8.8.8.8 for checking
on whether validation is broken is not the best idea.<br>-- <br>R. Kevin Oberman, Network Engineer<br>E-mail: <a href="mailto:rkoberman@gmail.com" target="_blank">rkoberman@gmail.com</a><br>
</div></div>