From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ig0-x22a.google.com (mail-ig0-x22a.google.com [IPv6:2607:f8b0:4001:c05::22a]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id D47F821F2B3 for ; Thu, 24 Apr 2014 05:33:20 -0700 (PDT) Received: by mail-ig0-f170.google.com with SMTP id uq10so973121igb.1 for ; Thu, 24 Apr 2014 05:33:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=PcNc5tuADg2CXi5oQzX4ouRlkLfPgg2G9lDdTSwTYo4=; b=b0YUBO+zUfpglW0oRWwtmGf9SczBQtnGwPo2idJqu70SB7pUW54iP+rFDkEf4ZE1CR xXW0wiiRdOfE990xC/VGc+ldOeBGl/h2uy/PQPpbOmdl6mhM4r17BXObO5+/5lLFJ3hR dyZckuckCAAeIWQKfCKoI/m6z0RvtILjQ5dAekMzD0twdEk8571WDi/2wTANpGh3VQKS f+Xqof1/VRYuav7lb32CEvkcMW8gKc3eM8TYLjBTdozhdTv4qJCPEFOqqggNSwbia7PA VEcxPlPAr5v8t2QYnQxZ38GC59o8Um44FZDb+jdFdf8gRploZHSjT2gTgpBUR5Kq4ubC XGeQ== MIME-Version: 1.0 X-Received: by 10.42.82.148 with SMTP id d20mr1561620icl.50.1398342800248; Thu, 24 Apr 2014 05:33:20 -0700 (PDT) Received: by 10.64.238.70 with HTTP; Thu, 24 Apr 2014 05:33:20 -0700 (PDT) In-Reply-To: <5358F53A.3050501@thekelleys.org.uk> References: <5357E336.6070406@thekelleys.org.uk> <5358F53A.3050501@thekelleys.org.uk> Date: Thu, 24 Apr 2014 14:33:20 +0200 Message-ID: From: Aaron Wood To: Simon Kelley Content-Type: multipart/alternative; boundary=90e6ba613a1ee216b204f7c90d3d Cc: dnsmasq-discuss , cerowrt-devel Subject: Re: [Cerowrt-devel] [Dnsmasq-discuss] more dnssec failures X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Apr 2014 12:33:21 -0000 --90e6ba613a1ee216b204f7c90d3d Content-Type: text/plain; charset=UTF-8 Well, I'm seeing the same results as you are from here in Paris (using Free.fr). -Aaron On Thu, Apr 24, 2014 at 1:27 PM, Simon Kelley wrote: > On 24/04/14 11:49, Aaron Wood wrote: > > > > >> Dnsmasq does the DS query next because the answer to the A query comes > >> back unsigned, so dnsmasq is looking for a DS record that proves this is > >> OK. It's likely that Verisign does that top-down (starting from the > >> root) whilst dnsmasq does it bottom up. Hence Verisign never finds the > >> broken DS, whilst dnsmasq does. > >> > >> That's as good an analysis as I can produce right now. Anyone who can > >> shed more light, please do. > >> > >> (And yes, please report DNSSEC problems on the dnsmasq-discuss list for > >> preference.) > >> > > > > This is still persisting (and it appears to be blocking a bunch of Apple > > software update functions). From your comments, Simon, it sounds like > you > > think this is an Akamai issue, and should be reported to them? > > > > I'm not absolutely sure that this isn't also a dnsmasq problem, and > DNSSEC is still capable of surprising me, but I can't see how a SERVFAIL > answer to > > dig @8.8.8.8 DS e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net > > can not be either a Google ('cause it's their recursive server) or > Akamai problem. > > Poking further, it looks like the authoritative name servers for that > zone are > > ; <<>> DiG 9.8.1-P1 <<>> @8.8.8.8 NS cn.akamaiedge.net > ; (1 server found) > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43031 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 0 > > ;; QUESTION SECTION: > ;cn.akamaiedge.net. IN NS > > ;; ANSWER SECTION: > cn.akamaiedge.net. 299 IN NS n7cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n6cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n0cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n2cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n5cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n4cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n3cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n1cn.akamaiedge.net. > cn.akamaiedge.net. 299 IN NS n8cn.akamaiedge.net. > > and all of those give sensible answers for > > DS e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net > > except n8cn.akamaiedge.net, which isn't responding, so I rather think > this may be a Google mess. > > Or maybe it's Great Firewall induced breakage? > > Cheers, > > > Simon. > > > > --90e6ba613a1ee216b204f7c90d3d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Well, I'm seeing the same results as you are from here= in Paris (using Free.fr).

-Aaron


On Thu, Apr 24, 2014 at= 1:27 PM, Simon Kelley <simon@thekelleys.org.uk> wrote= :
On 24/04/14 11:49, Aaron Woo= d wrote:

>
>> Dnsmasq does the DS query next because the answer to the A query c= omes
>> back unsigned, so dnsmasq is looking for a DS record that proves t= his is
>> OK. It's likely that Verisign does that top-down (starting fro= m the
>> root) whilst dnsmasq does it bottom up. Hence Verisign never finds= the
>> broken DS, whilst dnsmasq does.
>>
>> That's as good an analysis as I can produce right now. Anyone = who can
>> shed more light, please do.
>>
>> (And yes, please report DNSSEC problems =C2=A0on the dnsmasq-discu= ss list for
>> preference.)
>>
>
> This is still persisting (and it appears to be blocking a bunch of App= le
> software update functions). =C2=A0From your comments, Simon, it sounds= like you
> think this is an Akamai issue, and should be reported to them?
>

I'm not absolutely sure that this isn't also a dnsmasq proble= m, and
DNSSEC is still capable of surprising me, but I can't see how a SERVFAI= L
answer to

dig @8.8.8.8 DS = e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net

can not be either a Google ('cause it's their recursive server) or<= br> Akamai problem.

Poking further, it looks like the authoritative name servers for that
zone are

; <<>> DiG 9.8.1-P1 <<>> @8.8.8.8 NS cn.akamaiedge.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43031=
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS

;; ANSWER SECTION:
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n7cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n6cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n0cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n2cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n5cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n4cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n3cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n1cn.= akamaiedge.net.
cn.akamaiedge.net. =C2=A0 =C2=A0 =C2=A0299 =C2=A0 =C2=A0 IN =C2=A0 =C2=A0 =C2=A0NS =C2=A0 = =C2=A0 =C2=A0n8cn.= akamaiedge.net.

and all of those give sensible answers for

DS e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net

except n8cn.akamai= edge.net, which isn't responding, so I rather think
this may be a Google mess.

Or maybe it's Great Firewall induced breakage?

Cheers,


Simon.




--90e6ba613a1ee216b204f7c90d3d--