<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>It sounds like I'm correct that lines of the sort:</p>
<p><font face="monospace">validating com/SOA: got insecure response;
parent indicates it should be secure</font></p>
<p>are my indication that dnssec is doing its job. (Whether I should
be reacting to messages like the above remains to be seen.)<br>
</p>
<p>Let me rephrase my original question (which remains unanswered):
Are there other strings in the log which similarly indicate dnssec
is doing its job and logging responses which can not be validated?</p>
<p>Of the lines like the above (for a sample day), 92% of them
indicate failure to validate SOA-records. Only 4% are for
A-records. Of those same lines, the most prevalent entris are the
SOA-records for:</p>
<p><font face="monospace">2% io<br>
2% us<br>
2% ip6.arpa<br>
2% pure.cloud<br>
2% org<br>
4% impervadns.net<br>
6% net<br>
7% cloudflare.net<br>
9% .<br>
33% com</font><br>
</p>
<p>It concerns me the SOA records I'm requesting are so often being
rejected as invalid.<br>
</p>
<p>I have my suspicions of what's happening, but not enough
information to form a solid hypothesis or perform tests. I want
higher confidence that I'm recognizing the important lines in the
logs before I start casting stones.<br>
</p>
<pre class="moz-signature" cols="72">--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
<div class="moz-cite-prefix">On 1/24/2023 5:26 AM, Michael
Richardson wrote:<br>
</div>
<blockquote type="cite" cite="mid:3642.1674570361@localhost">
<pre class="moz-quote-pre" wrap="">John Thurston <a class="moz-txt-link-rfc2396E" href="mailto:john.thurston@alaska.gov" moz-do-not-send="true"><john.thurston@alaska.gov></a> wrote:
> On a resolver running ISC BIND 9.16.36 with "dnssec-validation auto;" I am
> writing "category dnssec" to a log file at "severity info;" When I look in
> the resulting log file, I'm guessing that lines like this:
> validating com/SOA: got insecure response; parent indicates it should be
> secure
> Are an indication I have a problem I should investigate.
Maybe.
It could be that DNSSEC is simply defending you against attackers who are
trying to race insecure answers to your queries in the belief that "nobody validates"
If it were systematic (every query, every query to some servers...) then you
should suspect that there is a on-path attacker modifying the responses.
That's unlikely in general, but it's why we have DNSSEC.
It could also be the result of corrupted packets that survive the UDP
checksum, or which go through a middle box that "fixes" that. Some satellite
systems do that. I imagine that Alaska might have at least one satellite link.
It doesn't sound like it's systematic, so I think they are off-path
attackers, and it looks like it's queries on .com?
Most likely, there is little you can do.
</pre>
</blockquote>
</body>
</html>