<div dir="ltr">Well, I'm seeing the same results as you are from here in Paris (using Free.fr).<div><br></div><div>-Aaron</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 24, 2014 at 1:27 PM, Simon Kelley <span dir="ltr"><<a href="mailto:simon@thekelleys.org.uk" target="_blank">simon@thekelleys.org.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 24/04/14 11:49, Aaron Wood wrote:<br>
<br>
><br>
>> Dnsmasq does the DS query next because the answer to the A query comes<br>
>> back unsigned, so dnsmasq is looking for a DS record that proves this is<br>
>> OK. It's likely that Verisign does that top-down (starting from the<br>
>> root) whilst dnsmasq does it bottom up. Hence Verisign never finds the<br>
>> broken DS, whilst dnsmasq does.<br>
>><br>
>> That's as good an analysis as I can produce right now. Anyone who can<br>
>> shed more light, please do.<br>
>><br>
>> (And yes, please report DNSSEC problems on the dnsmasq-discuss list for<br>
>> preference.)<br>
>><br>
><br>
> This is still persisting (and it appears to be blocking a bunch of Apple<br>
> software update functions). From your comments, Simon, it sounds like you<br>
> think this is an Akamai issue, and should be reported to them?<br>
><br>
<br>
</div>I'm not absolutely sure that this isn't also a dnsmasq problem, and<br>
DNSSEC is still capable of surprising me, but I can't see how a SERVFAIL<br>
answer to<br>
<br>
dig @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> DS <a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net" target="_blank">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a><br>
<br>
can not be either a Google ('cause it's their recursive server) or<br>
Akamai problem.<br>
<br>
Poking further, it looks like the authoritative name servers for that<br>
zone are<br>
<br>
; <<>> DiG 9.8.1-P1 <<>> @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> NS <a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a><br>
<div class="">; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
</div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43031<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 0<br>
<br>
;; QUESTION SECTION:<br>
;<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. IN NS<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n7cn.akamaiedge.net" target="_blank">n7cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n6cn.akamaiedge.net" target="_blank">n6cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n0cn.akamaiedge.net" target="_blank">n0cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n2cn.akamaiedge.net" target="_blank">n2cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n5cn.akamaiedge.net" target="_blank">n5cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n4cn.akamaiedge.net" target="_blank">n4cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n3cn.akamaiedge.net" target="_blank">n3cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n1cn.akamaiedge.net" target="_blank">n1cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n8cn.akamaiedge.net" target="_blank">n8cn.akamaiedge.net</a>.<br>
<br>
and all of those give sensible answers for<br>
<br>
DS <a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net" target="_blank">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a><br>
<br>
except <a href="http://n8cn.akamaiedge.net" target="_blank">n8cn.akamaiedge.net</a>, which isn't responding, so I rather think<br>
this may be a Google mess.<br>
<br>
Or maybe it's Great Firewall induced breakage?<br>
<br>
Cheers,<br>
<br>
<br>
Simon.<br>
<br>
<br>
<br>
</blockquote></div><br></div>