Skip to content
Snippets Groups Projects

When +DO bit is set, return DNSSEC related records in answers

    • Closed Issue created by Ondřej Surý @ondrej

    Compare Knot Resolver:

    $ dig +noall +answer +dnssec +multi pir.org +dnssec @::1
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 59946
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 4096 B; ext-rcode: Unused

;; ANSWER SECTION:
pir.org.            	211 IN A 97.107.141.235

;; Received 52 B
;; Time 2017-01-13 13:47:26 CET
;; From ::1@53(UDP) in 0.1 ms

    vs Google PDNS:

    $ dig +noall +answer +dnssec +multi pir.org +dnssec @8.8.8.8
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 42672
;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 2; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 512 B; ext-rcode: Unused

;; ANSWER SECTION:
pir.org.            	299 IN A 97.107.141.235
pir.org.            	299 IN RRSIG A 5 2 300 20170127084000 (
				20170113084000 12020 pir.org.
				ictBcdN3BDiX3z4w6VHmJYHZQoRONbxqITAc8EQS
				vXXI20BA9vsrKjJdrCtY6U8iMGBqS+uV9hWO+38k
				lVBRBnW5NB53m47g2cJ1de4GDphjhVWg/G9HhTs2
				lPfKXsBKvZVWYQgM1ArSTYjzGa45V8Enb7DETjuI
				Z7Sr1noI6mM=
				)

;; Received 219 B
;; Time 2017-01-13 13:47:33 CET
;; From 8.8.8.8@53(UDP) in 48.4 ms
    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

    • Ondřej Surý changed milestone to %1.2.0 release

      changed milestone to %1.2.0 release

    • Ondřej Surý
      Ondřej Surý @ondrej ·
      Author Guest

      Clean cache log:

      [    0][plan] plan 'pir.org.' type 'A'
[33830][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[33830][resl]   => using root hints
[ 6984][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[ 6984][plan]   plan '.' type 'DNSKEY'
[46719][iter]     '.' type 'DNSKEY' id was assigned, parent id 6984
[46719][resl]     => querying: '2001:dc3::35' score: 10 zone cut: '.' m12n: '.' type: 'DNSKEY' proto: 'udp'
[46719][iter]     <= rcode: NOERROR
[46719][vldr]     <= parent: updating DNSKEY
[46719][vldr]     <= answer valid, OK
[46719][resl]     <= server: '2001:dc3::35' rtt: 18 ms
[28503][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[28503][resl]   => querying: '2001:500:9f::42' score: 10 zone cut: '.' m12n: 'oRG.' type: 'NS' proto: 'udp'
[28503][iter]   <= using glue for 'a0.org.afilias-nst.info.': '199.19.56.1'
[28503][iter]   <= using glue for 'a0.org.afilias-nst.info.': '2001:500:e::1'
[28503][iter]   <= using glue for 'a2.org.afilias-nst.info.': '199.249.112.1'
[28503][iter]   <= using glue for 'a2.org.afilias-nst.info.': '2001:500:40::1'
[28503][iter]   <= using glue for 'b0.org.afilias-nst.org.': '199.19.54.1'
[28503][iter]   <= using glue for 'b0.org.afilias-nst.org.': '2001:500:c::1'
[28503][iter]   <= using glue for 'b2.org.afilias-nst.org.': '199.249.120.1'
[28503][iter]   <= using glue for 'b2.org.afilias-nst.org.': '2001:500:48::1'
[28503][iter]   <= using glue for 'c0.org.afilias-nst.info.': '199.19.53.1'
[28503][iter]   <= using glue for 'c0.org.afilias-nst.info.': '2001:500:b::1'
[28503][iter]   <= using glue for 'd0.org.afilias-nst.org.': '199.19.57.1'
[28503][iter]   <= using glue for 'd0.org.afilias-nst.org.': '2001:500:f::1'
[28503][iter]   <= referral response, follow
[28503][vldr]   <= DS: OK
[28503][vldr]   <= answer valid, OK
[28503][resl]   <= server: '2001:500:9f::42' rtt: 1 ms
[56357][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[56357][plan]   plan 'org.' type 'DNSKEY'
[16163][iter]     'org.' type 'DNSKEY' id was assigned, parent id 56357
[16163][resl]     => querying: '2001:500:f::1' score: 10 zone cut: 'org.' m12n: 'ORg.' type: 'DNSKEY' proto: 'udp'
[16163][iter]     <= rcode: NOERROR
[16163][vldr]     <= parent: updating DNSKEY
[16163][vldr]     <= answer valid, OK
[16163][resl]     <= server: '2001:500:f::1' rtt: 162 ms
[53702][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[53702][resl]   => querying: '199.19.57.1' score: 10 zone cut: 'org.' m12n: 'piR.oRG.' type: 'A' proto: 'udp'
[53702][iter]   <= referral response, follow
[53702][vldr]   <= DS: OK
[53702][vldr]   <= answer valid, OK
[53702][resl]   <= server: '199.19.57.1' rtt: 104 ms
[51332][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[51332][plan]   plan 'pir.org.' type 'DNSKEY'
[55653][iter]     'pir.org.' type 'DNSKEY' id was assigned, parent id 51332
[55653][plan]     plan 'ns1.yyz1.afilias-nst.info.' type 'AAAA'
[33974][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[33974][resl]       => using root hints
[62051][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[62051][plan]       plan '.' type 'DNSKEY'
[38427][iter]         '.' type 'DNSKEY' id was assigned, parent id 62051
[38427][ rc ]         => satisfied from cache
[38427][iter]         <= rcode: NOERROR
[38427][vldr]         <= parent: updating DNSKEY
[38427][vldr]         <= answer valid, OK
[14402][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[14402][resl]       => querying: '2001:500:9f::42' score: 11 zone cut: '.' m12n: 'INFO.' type: 'NS' proto: 'udp'
[14402][iter]       <= using glue for 'a0.info.afilias-nst.info.': '199.254.31.1'
[14402][iter]       <= using glue for 'a0.info.afilias-nst.info.': '2001:500:19::1'
[14402][iter]       <= using glue for 'a2.info.afilias-nst.info.': '199.249.113.1'
[14402][iter]       <= using glue for 'a2.info.afilias-nst.info.': '2001:500:41::1'
[14402][iter]       <= using glue for 'b0.info.afilias-nst.org.': '199.254.48.1'
[14402][iter]       <= using glue for 'b0.info.afilias-nst.org.': '2001:500:1a::1'
[14402][iter]       <= using glue for 'b2.info.afilias-nst.org.': '199.249.121.1'
[14402][iter]       <= using glue for 'b2.info.afilias-nst.org.': '2001:500:49::1'
[14402][iter]       <= using glue for 'c0.info.afilias-nst.info.': '199.254.49.1'
[14402][iter]       <= using glue for 'c0.info.afilias-nst.info.': '2001:500:1b::1'
[14402][iter]       <= using glue for 'd0.info.afilias-nst.org.': '199.254.50.1'
[14402][iter]       <= using glue for 'd0.info.afilias-nst.org.': '2001:500:1c::1'
[14402][iter]       <= referral response, follow
[14402][vldr]       <= DS: OK
[14402][vldr]       <= answer valid, OK
[14402][resl]       <= server: '2001:500:9f::42' rtt: 1 ms
[12569][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[12569][plan]       plan 'info.' type 'DNSKEY'
[21546][iter]         'info.' type 'DNSKEY' id was assigned, parent id 12569
[21546][resl]         => querying: '2001:500:1c::1' score: 10 zone cut: 'info.' m12n: 'iNfO.' type: 'DNSKEY' proto: 'udp'
[21546][iter]         <= rcode: NOERROR
[21546][vldr]         <= parent: updating DNSKEY
[21546][vldr]         <= answer valid, OK
[21546][resl]         <= server: '2001:500:1c::1' rtt: 165 ms
[20402][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[20402][resl]       => querying: '199.254.50.1' score: 10 zone cut: 'info.' m12n: 'afILias-nst.INFO.' type: 'NS' proto: 'udp'
[20402][iter]       <= using glue for 'd0.dig.afilias-nst.info.': '65.22.9.1'
[20402][iter]       <= using glue for 'd0.dig.afilias-nst.info.': '2a01:8840:9::1'
[20402][iter]       <= using glue for 'b0.dig.afilias-nst.info.': '65.22.7.1'
[20402][iter]       <= using glue for 'b0.dig.afilias-nst.info.': '2a01:8840:7::1'
[20402][iter]       <= using glue for 'c0.dig.afilias-nst.info.': '65.22.8.1'
[20402][iter]       <= using glue for 'c0.dig.afilias-nst.info.': '2a01:8840:8::1'
[20402][iter]       <= using glue for 'a0.dig.afilias-nst.info.': '65.22.6.1'
[20402][iter]       <= using glue for 'a0.dig.afilias-nst.info.': '2a01:8840:6::1'
[20402][iter]       <= referral response, follow
[20402][vldr]       <= DS doesn't exist, going insecure
[20402][vldr]       <= parent: updating DS
[20402][vldr]       <= answer valid, OK
[20402][resl]       <= server: '199.254.50.1' rtt: 95 ms
[33103][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[33103][resl]       => querying: '2a01:8840:9::1' score: 10 zone cut: 'afilias-nst.info.' m12n: 'yyZ1.aFILIas-nst.INFo.' type: 'NS' proto: 'udp'
[33103][iter]       <= rcode: NOERROR
[33103][iter]       <= found cut, retrying with non-minimized name
[33103][resl]       <= server: '2a01:8840:9::1' rtt: 166 ms
[27008][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[27008][resl]       => querying: '65.22.9.1' score: 10 zone cut: 'afilias-nst.info.' m12n: 'NS1.YYz1.aFiLIAS-nst.iNfO.' type: 'AAAA' proto: 'udp'
[27008][iter]       <= using glue for 'b0.dig.afilias-nst.info.': '65.22.7.1'
[27008][iter]       <= using glue for 'b0.dig.afilias-nst.info.': '2a01:8840:7::1'
[27008][iter]       <= using glue for 'c0.dig.afilias-nst.info.': '65.22.8.1'
[27008][iter]       <= using glue for 'c0.dig.afilias-nst.info.': '2a01:8840:8::1'
[27008][iter]       <= using glue for 'a0.dig.afilias-nst.info.': '65.22.6.1'
[27008][iter]       <= using glue for 'a0.dig.afilias-nst.info.': '2a01:8840:6::1'
[27008][iter]       <= using glue for 'd0.dig.afilias-nst.info.': '65.22.9.1'
[27008][iter]       <= using glue for 'd0.dig.afilias-nst.info.': '2a01:8840:9::1'
[27008][iter]       <= referral response, follow
[27008][resl]       <= server: '65.22.9.1' rtt: 95 ms
[45637][iter]       'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 55653
[45637][resl]       => querying: '2a01:8840:8::1' score: 10 zone cut: 'yyz1.afilias-nst.info.' m12n: 'Ns1.yYZ1.aFIlIaS-nsT.inFO.' type: 'AAAA' proto: 'udp'
[45637][iter]       <= rcode: NOERROR
[45637][resl]       <= server: '2a01:8840:8::1' rtt: 14 ms
[64852][iter]     'pir.org.' type 'DNSKEY' id was assigned, parent id 51332
[64852][resl]     => querying: '2a01:8840:9::1' score: 166 zone cut: 'pir.org.' m12n: 'PIR.Org.' type: 'DNSKEY' proto: 'udp'
[64852][iter]     <= rcode: NOERROR
[64852][resl]     <= server: '2a01:8840:9::1' rtt: 164 ms
[ 3795][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[ 3795][plan]   plan 'pir.org.' type 'DNSKEY'
[59425][iter]     'pir.org.' type 'DNSKEY' id was assigned, parent id 3795
[59425][ rc ]     => satisfied from cache
[59425][iter]     <= rcode: NOERROR
[59425][vldr]     <= cached insecure response, going insecure
[37016][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[37016][plan]   plan 'ns1.yyz1.afilias-nst.info.' type 'AAAA'
[32823][iter]     'ns1.yyz1.afilias-nst.info.' type 'AAAA' id was assigned, parent id 37016
[32823][ rc ]     => satisfied from cache
[32823][iter]     <= rcode: NOERROR
[32823][vldr]     <= cached insecure response, going insecure
[50358][iter]   'pir.org.' type 'A' id was assigned, parent id 0
[50358][resl]   => querying: '2a01:8840:9::1' score: 165 zone cut: 'pir.org.' m12n: 'PiR.OrG.' type: 'A' proto: 'udp'
[50358][iter]   <= rcode: NOERROR
[50358][resl]   <= server: '2a01:8840:9::1' rtt: 162 ms
[    0][resl] finished: 4, queries: 9, mempool: 82000 B
    • Vladimír Čunát
      Vladimír Čunát @vcunat ·
      Owner

      The problem is just for some domains – those that are deemed insecure by mistake (!)

    • Grigorii Demidov mentioned in merge request !140 (merged)

      mentioned in merge request !140 (merged)

    • Ondřej Surý closed via commit 824a7b3b

      closed via commit 824a7b3b

    • Ondřej Surý closed via merge request !140 (merged)

      closed via merge request !140 (merged)

    • Ondřej Surý mentioned in commit 824a7b3b

      mentioned in commit 824a7b3b

    • Štěpán Balážik assigned to @sbalazik

      assigned to @sbalazik

    • Štěpán Balážik
      Štěpán Balážik @sbalazik ·
      Maintainer

      Assigned to myself to prepare a test:

      Broken eg. in ed9032b5

      Working eg. in e68c8ce1

      Edited by Štěpán Balážik
    • Aleš Mrázek mentioned in commit 2d6190e6

      mentioned in commit 2d6190e6

    • Aleš Mrázek mentioned in commit 73e3a4e5

      mentioned in commit 73e3a4e5

    • Aleš Mrázek mentioned in commit 397f2275

      mentioned in commit 397f2275

    • Aleš Mrázek mentioned in commit 5e27b7d1

      mentioned in commit 5e27b7d1

    • Aleš Mrázek mentioned in commit f9b90867

      mentioned in commit f9b90867

    Please register or sign in to reply