Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add DNSKEY/RRSIG existence but missing DS in results_technical in API #979

Open
bwbroersma opened this issue May 11, 2023 · 0 comments
Open

Comments

@bwbroersma
Copy link
Collaborator

For research purposes it would be nice to see when a domain fails for DNSSEC, but does provide DNSSEC signatures and has a DNSKEY.

Forged example (via direct URL entry, since the domain does not provide an A-record so doesn't pass the initial qualification to be checked) is randstad380kv-noordring.nl, see the current test report which obviously fails because of a missing DS-record:

$ dig +noall  +question +answer +dnssec DNSKEY randstad380kv-noordring.nl
;randstad380kv-noordring.nl.	IN	DNSKEY
randstad380kv-noordring.nl. 43200 IN	DNSKEY	257 3 13 4WrilUFwJ71BsKhUMGv3Kn2xLV1O8JV/jdGvHQvkDipGZFZ+2lLb5x2H P3dmhxOQcPbwNtAOISjuoIlmplvXAg==
randstad380kv-noordring.nl. 43200 IN	RRSIG	DNSKEY 13 2 86400 20230525000000 20230504000000 39760 randstad380kv-noordring.nl. ugHPV/sqNIUw3RWIYU2Wm8Utxx3P2AGb9Ad9iJRRGMflImhcmEHipHq5 mmf5SAip2dCBOGdIECzdwjeJ++xS8A==

$ dig +noall +question +answer DS randstad380kv-noordring.nl
;randstad380kv-noordring.nl.	IN	DS

It would be nice to know it's failing because the DS records are not set up.

Other linked relevant issues that could bring more DNSSEC info to the API: #188, #976 and #978.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

1 participant