Re: [public-dns-discuss] Not resolving CNAME if zone is signed with DNSSEC?

[Yunhong Gu]

Because your name server does not return signature for the A record returned together with the CName record.

; <<>> DiG 9.8.1-P1 <<>> www.viedoc.com +dnssec +norec @ns1.interactivehealthgroup.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2038

;; flags: qr aa; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags: do; udp: 1280

;; QUESTION SECTION:

;www.viedoc.com. IN A

;; ANSWER SECTION:

www.viedoc.com. 3600 IN CNAME viedoc.com.

www.viedoc.com. 3600 IN RRSIG CNAME 7 3 3600 20131210073246 20121115073246 53247 viedoc.com. WZ0/nAOLd0jnsqjZKu3r6qszMdQeAhT3oWGh4SQbbJZ6V0Nfwdu4dBVI dqZF9Bnspoqk8LFuAxZvxi16eme+Hw==

viedoc.com. 3600 IN A 212.112.175.146

;; AUTHORITY SECTION:

viedoc.com. 3600 IN NS ns1.interactivehealthgroup.com.

viedoc.com. 3600 IN NS ns2.interactivehealthgroup.com.

;; ADDITIONAL SECTION:

ns1.interactivehealthgroup.com. 3600 IN A 212.112.175.151

ns2.interactivehealthgroup.com. 3600 IN A 212.112.175.152

;; Query time: 106 msec

;; SERVER: 212.112.175.151#53(212.112.175.151)

;; WHEN: Mon May 13 15:33:18 2013

;; MSG SIZE  rcvd: 270

On Mon, May 13, 2013 at 3:20 PM, <jens.pe...@gmail.com> wrote:

Same authoritative DNS-server; CNAME www in DNSSEC signed zone viedoc.com does not resolve (www.viedoc.com), whereas CNAME www in non-signed zone viedoc.eu resolves (www.viedoc.eu).

Any ideas?

--
--
========================================================
You received this message because you are subscribed to the Google
Groups "public-dns-discuss" group.
To post to this group, send email to public-dn...@googlegroups.com
To unsubscribe from this group, send email to
public-dns-disc...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/public-dns-discuss?hl=en
For more information on Google Public DNS, please visit
http://code.google.com/speed/public-dns
========================================================
 
---
You received this message because you are subscribed to the Google Groups "public-dns-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to public-dns-disc...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Yunhong Gu]

On Mon, May 13, 2013 at 3:51 PM, <jens.pe...@gmail.com> wrote:

So it's because of bad DNSSEC implementation and the fact that Google DNS is actually DNSSEC aware, and almost everyone else isn't?

Yes.

 

Just strange since it worked up until a week ago, or so...

We turned on validation by default recently.