<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">This could be a result of KeyTrap mitigations.<div><br></div><div>The number of DS records is weird, but as long as there’s a valid path from root and no conflicting keytags, this looks fine to me.</div><div><br></div><div>Ondrej<br id="lineBreakAtBeginningOfSignature"><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 9. 8. 2024, at 20:56, John Thurston <john.thurston@alaska.gov> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p>Our up-stream resolver (Akamai) is unable to validate
scra.dmdc.osd.mil, when my 9.18.28 BIND resolver is able to. I
think my BIND server is doing it correctly, and the Akamai
resolver is not.<br>
</p>
<p>The nice dnsviz visualizer
<a class="moz-txt-link-freetext" href="https://dnsviz.net/d/scra.dmdc.osd.mil/dnssec/">https://dnsviz.net/d/scra.dmdc.osd.mil/dnssec/</a> leads me to suspect
that Akamai is choking on the presence of the SHA-1 records
(rather than ignoring them and accepting the SHA-256 records).</p>
<p>My bench-check of the behavior of BIND appears correct to me, but
I'm seeking confirmation.</p>
<p><br>
</p>
<p>When I <i>delv</i> locally for that A-record, I find a CNAME,
another CNAME, and an A. My BIND resolver is able to validate all
of the responses.</p>
<p>When I ask the Akamai resolver, it chokes. Unfortunately, I can't
offer the query for anyone else to try, because AFAIK Akamai
doesn't have a publicly-accessible resolver. But this is what I
get when I +mtrace +vtrace :<br>
</p>
<p>
</p><blockquote type="cite">;; fetch: scra.dmdc.osd.mil/A<br>
;; received packet from 96.7.136.4#53<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
54760<br>
;; flags: qr rd ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0,
ADDITIONAL: 0<br>
;; QUESTION SECTION:<br>
;scra.dmdc.osd.mil. IN A<br>
<br>
;; ANSWER SECTION:<br>
;scra.dmdc.osd.mil. 10 IN A 214.16.194.43<br>
<br>
<br>
;; validating scra.dmdc.osd.mil/A: starting<br>
;; validating scra.dmdc.osd.mil/A: attempting insecurity proof<br>
;; validating scra.dmdc.osd.mil/A: checking existence of DS at
'mil'<br>
;; fetch: mil/DS<br>
;; received packet from 96.7.136.4#53<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
41961<br>
;; flags: qr rd ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0,
ADDITIONAL: 0<br>
;; QUESTION SECTION:<br>
;mil. IN DS<br>
<br>
;; ANSWER SECTION:<br>
;mil. 86400 IN DS 16801 8 2 (<br>
;
49013E5D5ED406C25C5A3E7F67C7<br>
;
56E34C925342A34BD64D7427536C<br>
; 366DF99A )<br>
<br>
<br>
;; validating mil/DS: starting<br>
;; validating mil/DS: attempting insecurity proof<br>
;; validating mil/DS: checking existence of DS at 'mil'<br>
;; validating mil/DS: continuing validation would lead to
deadlock: aborting validation<br>
;; validating mil/DS: deadlock found (create_fetch)<br>
;; no valid RRSIG resolving 'mil/DS/IN': 96.7.136.4#53<br>
;; validating scra.dmdc.osd.mil/A: in fetch_callback_ds<br>
;; validating scra.dmdc.osd.mil/A: fetch_callback_ds: got
SERVFAIL<br>
;; broken trust chain resolving 'scra.dmdc.osd.mil/A/IN':
96.7.136.4#53<br>
;; resolution failed: broken trust chain<br>
</blockquote>
<p></p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
<span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></div></body></html>