[Cerowrt-devel] [Dnsmasq-discuss] more dnssec failures
simon at thekelleys.org.uk
Thu Apr 24 07:27:54 EDT 2014
On 24/04/14 11:49, Aaron Wood wrote:
>> Dnsmasq does the DS query next because the answer to the A query comes
>> back unsigned, so dnsmasq is looking for a DS record that proves this is
>> OK. It's likely that Verisign does that top-down (starting from the
>> root) whilst dnsmasq does it bottom up. Hence Verisign never finds the
>> broken DS, whilst dnsmasq does.
>> That's as good an analysis as I can produce right now. Anyone who can
>> shed more light, please do.
>> (And yes, please report DNSSEC problems on the dnsmasq-discuss list for
> This is still persisting (and it appears to be blocking a bunch of Apple
> software update functions). From your comments, Simon, it sounds like you
> think this is an Akamai issue, and should be reported to them?
I'm not absolutely sure that this isn't also a dnsmasq problem, and
DNSSEC is still capable of surprising me, but I can't see how a SERVFAIL
dig @220.127.116.11 DS e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net
can not be either a Google ('cause it's their recursive server) or
Poking further, it looks like the authoritative name servers for that
; <<>> DiG 9.8.1-P1 <<>> @18.104.22.168 NS cn.akamaiedge.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43031
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;cn.akamaiedge.net. IN NS
;; ANSWER SECTION:
cn.akamaiedge.net. 299 IN NS n7cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n6cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n0cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n2cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n5cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n4cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n3cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n1cn.akamaiedge.net.
cn.akamaiedge.net. 299 IN NS n8cn.akamaiedge.net.
and all of those give sensible answers for
except n8cn.akamaiedge.net, which isn't responding, so I rather think
this may be a Google mess.
Or maybe it's Great Firewall induced breakage?
More information about the Cerowrt-devel