My validating BIND caches are currently returning SERVFAIL while resolving queries for www.cpan.org. After traversing two CNAMEs, this name eventually points to cpan-global.l.develooper.org.
The domain develooper.org is signed and serverd by develooper.org. 432000 IN NS ns1.us.bitnames.com. develooper.org. 432000 IN NS ns3.us.bitnames.com. develooper.org. 432000 IN NS ns2.us.bitnames.com. develooper.org. 432000 IN NS ns2.eu.bitnames.com. develooper.org. 432000 IN NS ns1.eu.bitnames.com. All of these servers are running PowerDNS 3.0.1. according to version.bind. l.develooper.org is a zone-cut. During validation, my caches are trying to proof whether this delegation is secure by checking for the DS record of l.develooper.org. This is what the authoritative servers for develooper.org return: ; <<>> DiG 9.8.1-P1 <<>> @ns1.us.bitnames.com l.develooper.org. ds +dnssec ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47403 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 2800 ;; QUESTION SECTION: ;l.develooper.org. IN DS ;; AUTHORITY SECTION: l.develooper.org. 172800 IN NS ns1.p20.dynect.net. l.develooper.org. 172800 IN NS ns2.p20.dynect.net. l.develooper.org. 172800 IN NS ns3.p20.dynect.net. l.develooper.org. 172800 IN NS ns4.p20.dynect.net. l.develooper.org. 172800 IN NSEC www.develooper.org. NS RRSIG NSEC l.develooper.org. 172800 IN RRSIG NSEC 8 3 172800 20120308000000 20120223000000 50380 develooper.org. Njz+JFzFm5X3aWxqYIllrQE3SdzxzS/9pwHo5npsjWT5J7pIDoRSc4Pw efxXNDR++yrnqlT3AuWWq3gkUM9YYYf72kxOGgaOmUUbGCWQrulcakS2 TZIV+uKz5RfnGgsEisWBlnATCLylZsRQJ2mZI0SGV3N2IbryVeuokZmV 6w8= ;; Query time: 177 msec ;; SERVER: 207.171.7.236#53(207.171.7.236) ;; WHEN: Fri Feb 24 14:23:58 2012 ;; MSG SIZE rcvd: 345 This is a referral. However, what is expected here is a NODATA response (AA flag, SOA and NSEC records in authority section). This renders insecure delegations bogus. Unless I'm overlooking something here, this needs to be fixed ASAP. -- Alex _______________________________________________ Pdns-dev mailing list [email protected] http://mailman.powerdns.com/mailman/listinfo/pdns-dev
