<div dir="ltr">Thanks Mark. Am I correct then that I need to either convince the administrator of that DNS to enable DNSSEC or configure my DNS with `dnssec-validation = no`?<div><br></div><div>Thanks,</div><div><br></div><div>Nick</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Dec 18, 2020 at 3:07 PM Mark Andrews <<a href="mailto:marka@isc.org">marka@isc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Correct it is not validating. Additionally it isn’t even DNSSES aware. It will need to be updated for you to validate through it. <br>
<br>
-- <br>
Mark Andrews<br>
<br>
> On 19 Dec 2020, at 05:07, Nicolas Bock <<a href="mailto:nicolas.bock@canonical.com" target="_blank">nicolas.bock@canonical.com</a>> wrote:<br>
> <br>
> Hi Mark,<br>
> <br>
> Thanks so much for the reply. I ran this command and am<br>
> getting the following:<br>
> <br>
> $ dig +dnssec ds com @<a href="http://10.0.0.3" rel="noreferrer" target="_blank">10.0.0.3</a><br>
> <br>
> ; <<>> DiG 9.10.6 <<>> +dnssec ds com @<a href="http://10.0.0.3" rel="noreferrer" target="_blank">10.0.0.3</a><br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36260<br>
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1<br>
> <br>
> ;; OPT PSEUDOSECTION:<br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
> ;; QUESTION SECTION:<br>
> ;com. IN DS<br>
> <br>
> ;; ANSWER SECTION:<br>
> com. 63779 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766<br>
> <br>
> ;; Query time: 307 msec<br>
> ;; SERVER: 10.0.0.3#53(10.0.0.3)<br>
> ;; WHEN: Fri Dec 18 11:26:28 CST 2020<br>
> ;; MSG SIZE rcvd: 80<br>
> <br>
> In other words, the forwarder returns a Delegation Signer<br>
> record but not an RRset Signature record. Presumably that<br>
> means that that the forwarder is not validating the zone?<br>
> <br>
> Thanks,<br>
> <br>
> Nick<br>
> <br>
>> On Thu, Dec 17 2020, Mark Andrews wrote:<br>
>> <br>
>> DNSSEC requires that forwarders support DNSSEC. Check that the forwarders return<br>
>> DNSSEC records when they are queried. The forwarders should also be validating to<br>
>> filter spoofed responses from the internet. You should be getting a answer like<br>
>> this if the forwarders are validating.<br>
>> <br>
>> [beetle:~] marka% dig +dnssec ds com<br>
>> <br>
>> ; <<>> DiG 9.15.4 <<>> +dnssec ds com<br>
>> ;; global options: +cmd<br>
>> ;; Got answer:<br>
>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31284<br>
>> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br>
>> <br>
>> ;; OPT PSEUDOSECTION:<br>
>> ; EDNS: version: 0, flags: do; udp: 4096<br>
>> ; COOKIE: 5cf268bbbafd31a9010000005fdc081a24542baf0ffea0bb (good)<br>
>> ;; QUESTION SECTION:<br>
>> ;com. IN DS<br>
>> <br>
>> ;; ANSWER SECTION:<br>
>> com. 40483 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766<br>
>> com. 40483 IN RRSIG DS 8 1 86400 20201229170000 20201216160000 26116 . cgPgcSi6cq++komd2l+PzrCsawleAikedcwcGk5PbNr1onkXZGNypJoF 7QQJ4GjMf4b7t+bO5f8szmo0cd2bz+DD0DMXoqUSFvEH4gOX9naoHcm0 90MS5Wfdeg43gNDSot/U74RJS1CS50U3SreFd2ZFIik9MlCHrSFLf/9V 7EqTJrs3xz9d/EG34O6qjaEqdw4GW40d3sA6kDGtSC+I9t4rttSEeasZ FnkZWLCOvzOLfYQlCVqaWpYCnvNdoQUPsbmDCEJf22tanPUft59hPRMu HmJAOKj77vy+kQWXaBcBo//NUX2asBLus8S7sJ9BDxpGUAsS9o+TdRlq YkIHBA==<br>
>> <br>
>> ;; Query time: 0 msec<br>
>> ;; SERVER: 127.0.0.1#53(127.0.0.1)<br>
>> ;; WHEN: Fri Dec 18 12:38:34 AEDT 2020<br>
>> ;; MSG SIZE rcvd: 395<br>
>> <br>
>> [beetle:~] marka% <br>
>> <br>
>> <br>
>>>> On 18 Dec 2020, at 11:36, Nicolas Bock <<a href="mailto:nicolas.bock@canonical.com" target="_blank">nicolas.bock@canonical.com</a>> wrote:<br>
>>> <br>
>>> Hi,<br>
>>> <br>
>>> When I configure my named to forward to our corporate DNS<br>
>>> servers (10.0.0.2 and 10.0.0.3), I end up getting error<br>
>>> messages such as<br>
>>> <br>
>>> Dec 17 20:58:06 dns-server named[843946]: fetch: <a href="http://www.canonical.com/A" rel="noreferrer" target="_blank">www.canonical.com/A</a><br>
>>> Dec 17 20:58:06 dns-server named[843946]: fetch: com/DS<br>
>>> Dec 17 20:58:06 dns-server named[843946]: delete_node(): 0x7fa7e331e010 <a href="http://www.canonical.com" rel="noreferrer" target="_blank">www.canonical.com</a> (bucket 15)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: delete_node(): 0x7fa7e331b080 com (bucket 2)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: no valid RRSIG resolving 'com/DS/IN': 10.0.0.2#53<br>
>>> Dec 17 20:58:06 dns-server named[843946]: delete_node(): 0x7fa7e331b080 com (bucket 2)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: no valid RRSIG resolving 'com/DS/IN': 10.0.0.3#53<br>
>>> Dec 17 20:58:06 dns-server named[843946]: delete_node(): 0x7fa7e331b080 com (bucket 2)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: no valid DS resolving '<a href="http://www.canonical.com/A/IN" rel="noreferrer" target="_blank">www.canonical.com/A/IN</a>': 10.0.0.2#53<br>
>>> Dec 17 20:58:06 dns-server named[843946]: delete_node(): 0x7fa7e331e010 <a href="http://www.canonical.com" rel="noreferrer" target="_blank">www.canonical.com</a> (bucket 15)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: validating <a href="http://www.canonical.com/A" rel="noreferrer" target="_blank">www.canonical.com/A</a>: bad cache hit (com/DS)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: delete_node(): 0x7fa7e331e010 <a href="http://www.canonical.com" rel="noreferrer" target="_blank">www.canonical.com</a> (bucket 15)<br>
>>> Dec 17 20:58:06 dns-server named[843946]: broken trust chain resolving '<a href="http://www.canonical.com/A/IN" rel="noreferrer" target="_blank">www.canonical.com/A/IN</a>': 10.0.0.3#53<br>
>>> <br>
>>> I don't quite understand why. Are 10.0.0.{2,3} incorrectly<br>
>>> set up for DNSSEC? It looks like DNSSEC is already breaking<br>
>>> for com. How can I trace what the root cause is?<br>
>>> <br>
>>> Thanks!<br>
>>> <br>
>>> Nick<br>
>>> _______________________________________________<br>
>>> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
>>> <br>
>>> ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
>>> <br>
>>> <br>
>>> bind-users mailing list<br>
>>> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
>>> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
> <br>
<br>
</blockquote></div>