Re: Question about resolver

2024-04-28 Thread Mark Andrews
This looks like Google has forgotten to create the zone 96.34.in-addr.arpa but have created 180.96.34.in-addr.arpa resulting in answers that should come from 96.34.in-addr.arpa getting REFUSED returned. DNSSEC validation and QNAME minimisation find these sorts of configuration errors. Intermed

Re: Question about resolver

2024-04-27 Thread J Doe
On 2024-04-26 16:45, Josh Kuo wrote: In this particular case, isn't the resolver attempting to do a reverse lookup of the IP address that's listed ? You are right, I missed that this is a reverse-mapping zone. In that case, run DNSSEC analyzer on the domain "180.96.34.in-addr.arpa" and

Re: Question about resolver

2024-04-27 Thread J Doe
On 2024-04-26 16:28, Mark Andrews wrote: DS records live in the parent zone and the RFC 1034 rules for serving zone break down when a grandparent zone and child zone are served by the same server. This is corrected be the client by looking for intermediate NS records to find the hidden deleg

Re: Question about resolver

2024-04-26 Thread Josh Kuo
> > In this particular case, isn't the resolver attempting to do a reverse > lookup of the IP address that's listed ? > > You are right, I missed that this is a reverse-mapping zone. In that case, run DNSSEC analyzer on the domain "180.96.34.in-addr.arpa" and you'll see the problem. Reverse-mapping

Re: Question about resolver

2024-04-26 Thread Mark Andrews
DS records live in the parent zone and the RFC 1034 rules for serving zone break down when a grandparent zone and child zone are served by the same server. This is corrected be the client by looking for intermediate NS records to find the hidden delegations then resuming the DS lookup. Named

Re: Question about resolver

2024-04-26 Thread J Doe
On 2024-04-25 08:55, Josh Kuo wrote: DS = Delegation Signer, it is the record type that a signed child upload to the parent zone. It's difficult to say for sure without more information such as which domain name you are trying to resolve, but looks like it is probably due to a mis-matching DS re

Re: Question about resolver

2024-04-25 Thread Josh Kuo
DS = Delegation Signer, it is the record type that a signed child upload to the parent zone. It's difficult to say for sure without more information such as which domain name you are trying to resolve, but looks like it is probably due to a mis-matching DS record between the child and the parent (s