-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 02/04/15 21:43, Dave Taht wrote: > On Thu, Apr 2, 2015 at 1:08 PM, Simon Kelley > <[email protected]> wrote: I get a BOGUS validation because > there's no DS record for bufferbloat.ne t > > bufferbloat.net uses dlv.isc.org, which dnsmasq doesn't support. I > think we went round this loop last year sometime. > >> I have to admit that we have not looked at how we did dnssec 4+ >> years back. It does (now) just appear that we are misconfigured. >> Attempts to reach www.ietf.org always return the RRSIGS. > > > What are you doing which allows this to validate? Maybe a > configured trust-anchor for bufferbloat.net? I guess the first > answer is being returned from upstream, and the second is coming > from the dnsmasq cache. It should have RRSIGs never-the-less, but I > can't work out what's happening until I understand how you're > getting validation at all . > >> I have no idea. I used comcast´s upstream resolvers.
Are you giving dnsmasq the --dnssec-debug flag? If so you'll still get a reply (wo an "ad" flag) when the validation fails. That (combined with the second reply coming from cache) would fit the data provided. If you remove the dnssec-debug flag, you should get consistent SERVFAIL replies. > >> (Next up for me is hammering dnssec via as many ways as I can >> come up with over ipv6, btw) > > I await developments...... S. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlUdq7IACgkQKPyGmiibgrdr7gCglfq0dC/oWCYtQJS5KRd1lErZ NCAAoIkI5y98kMcDLJtfbx2hEGtfcaDm =ceEu -----END PGP SIGNATURE----- _______________________________________________ Dnsmasq-discuss mailing list [email protected] http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
