[dns-operations] Cloudflare considered harmful?

[Viktor Dukhovni]

On Thu, Apr 16, 2020 at 11:47:53AM -0700, Vicky Shrestha wrote:

> The fix is being rolled out to our canary POPs and it should be deployed in
> rest of the network next week.

Any chance you're also fixing the (likely DNAME-related) issue that's
breaking resolution of:

    _25._tcp.blue.xy1.nl. IN TLSA ? ; ServFail

>From other public resolvers I get:

    ; NoError AD=1
    ;
    _tcp.blue.xy1.nl. IN DNAME _tcp.xy1.nl.
    _25._tcp.blue.xy1.nl. IN CNAME _25._tcp.xy1.nl.
    _25._tcp.xy1.nl. IN CNAME _dane.xy1.nl.
    _dane.xy1.nl. IN TLSA 2 1 1 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18

The TLSA lookup failure can break email deliver from DANE-enabled MTAs
that use Cloudflare DNS forwarders.

-- 
    Viktor.