<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Valid base64 includes spaces and new lines. Poorly written record parsers reject valid records. <br><br><div dir="ltr">-- <div>Mark Andrews</div></div><div dir="ltr"><br><blockquote type="cite">On 30 Dec 2022, at 10:38, Eric Germann via bind-users <bind-users@lists.isc.org> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><br>
<div><br><div>On Dec 29, 2022, at 16:34, Timothe Litt <litt@acm.org> wrote:</div><br><div><snip></div><br>Yup, Eric's case was a classic example. He tried to do the right
thing, put in the wrong record, and the system didn't produce the
expected results. To his credit, he persisted. Most people
don't. A while ago there was a study (<a moz-do-not-send="true" href="https://blog.cloudflare.com/automatically-provision-and-maintain-dnssec/">cloudflare/APNIC</a>)
that showed that about only about 40% of people who enabled DNSSEC
for their accounts successfully served DS records in their
registry.<br></div><div><br></div><div></snip></div><div><br></div><div>The really annoying part is it isn’t obvious that they want the public key and not the result of dnssec-dsfromkey; they do it themselves. The annoying part is they throw an error if the key isn’t valid Base64 (think spaces or newlines), but gladly accept the DS output from dnssec-dsfromkey. Somehow or another they are getting the key tag from the incorrect DS record, because they encode again the already encoded string.</div><div><br></div><div>I looked in the docs for boto3 (the official API for AWS) and there appears no way to add a public key so you can’t do it programmatically.</div><div><br></div><div>I’ll have to pass that on to my AWS contacts. Doubt they’ll do anything but it is worth throwing it over the fence.</div><div><br></div><div>Again, thanks for all the help!</div><div><br></div><div>Eric</div><div><br></div><span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></body></html>