[dns-operations] Lack of tlsa support

Shumon Huque shuque at gmail.com
Wed May 27 19:59:59 UTC 2015 

On Wed, May 27, 2015 at 3:40 PM, Warren Kumari <warren at kumari.net> wrote:

> On Wed, May 27, 2015 at 3:02 PM, Joe Abley <jabley at hopcount.ca> wrote:
> >
> >
> > On 27 May 2015, at 19:14, Warren Kumari wrote:
> >
> >>> For what it's worth, I have no problem getting a reasonable (negative)
> >>> response to ACCOUNTANT/IN/TLSA or SOMETHING.ACCOUNTANT/IN/TLSA from
> >>> 156.154.144.195 with EDNS0.DO=1 or without EDNS0. Perhaps I'm special
> :-)
>
> Yah, /I/ know you are special -- but I don't know how 156.154.144.195
> knows you are.
>
> Can you include a dig (or similar) showing you asking the question and
> getting an answer (not a timeout?). I've queried from multiple places
> with no love...
>
> W
>
>
>
Here's a transcript of my attempt to query all the NS addresses at
accountant for TLSA records (from one location, a datacenter in New
Jersey). Quick summary: no response/timeout from all the IPv4 addresses,
correct NODATA answers from all the IPv6 addresses. Hmm (and no, the
machine originating the queries has working IPv4 and can query other
records successfully):

$ get-ns-ip accountant.
ns1.dns.nic.accountant. 156.154.144.195
ns1.dns.nic.accountant. 2610:a1:1071::c3
ns2.dns.nic.accountant. 156.154.145.195
ns2.dns.nic.accountant. 2610:a1:1072::c3
ns3.dns.nic.accountant. 156.154.159.195
ns3.dns.nic.accountant. 2610:a1:1073::c3
ns4.dns.nic.accountant. 156.154.156.195
ns4.dns.nic.accountant. 2610:a1:1074::c3
ns5.dns.nic.accountant. 156.154.157.195
ns5.dns.nic.accountant. 2610:a1:1075::c3
ns6.dns.nic.accountant. 156.154.158.195
ns6.dns.nic.accountant. 2610:a1:1076::c3

$ get-ns-ip accountant. | while read hostname ip
> do
>     echo ">>> $hostname $ip"
>     dig @$ip _443._tcp.accountant. TLSA
>     echo ""
> done

>>> ns1.dns.nic.accountant. 156.154.144.195

; <<>> DiG 9.10.1 <<>> @156.154.144.195 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

>>> ns1.dns.nic.accountant. 2610:a1:1071::c3

; <<>> DiG 9.10.1 <<>> @2610:a1:1071::c3 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45660
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;_443._tcp.accountant. IN TLSA

;; AUTHORITY SECTION:
accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189
900 900 604800 86400

;; Query time: 8 msec
;; SERVER: 2610:a1:1071::c3#53(2610:a1:1071::c3)
;; WHEN: Wed May 27 15:50:11 EDT 2015
;; MSG SIZE  rcvd: 108


>>> ns2.dns.nic.accountant. 156.154.145.195

; <<>> DiG 9.10.1 <<>> @156.154.145.195 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

>>> ns2.dns.nic.accountant. 2610:a1:1072::c3

; <<>> DiG 9.10.1 <<>> @2610:a1:1072::c3 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8407
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;_443._tcp.accountant. IN TLSA

;; AUTHORITY SECTION:
accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189
900 900 604800 86400

;; Query time: 79 msec
;; SERVER: 2610:a1:1072::c3#53(2610:a1:1072::c3)
;; WHEN: Wed May 27 15:50:27 EDT 2015
;; MSG SIZE  rcvd: 108


>>> ns3.dns.nic.accountant. 156.154.159.195

; <<>> DiG 9.10.1 <<>> @156.154.159.195 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

>>> ns3.dns.nic.accountant. 2610:a1:1073::c3

; <<>> DiG 9.10.1 <<>> @2610:a1:1073::c3 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46624
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;_443._tcp.accountant. IN TLSA

;; AUTHORITY SECTION:
accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189
900 900 604800 86400

;; Query time: 8 msec
;; SERVER: 2610:a1:1073::c3#53(2610:a1:1073::c3)
;; WHEN: Wed May 27 15:50:42 EDT 2015
;; MSG SIZE  rcvd: 108


>>> ns4.dns.nic.accountant. 156.154.156.195

; <<>> DiG 9.10.1 <<>> @156.154.156.195 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

>>> ns4.dns.nic.accountant. 2610:a1:1074::c3

; <<>> DiG 9.10.1 <<>> @2610:a1:1074::c3 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21156
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;_443._tcp.accountant. IN TLSA

;; AUTHORITY SECTION:
accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189
900 900 604800 86400

;; Query time: 8 msec
;; SERVER: 2610:a1:1074::c3#53(2610:a1:1074::c3)
;; WHEN: Wed May 27 15:50:57 EDT 2015
;; MSG SIZE  rcvd: 108


>>> ns5.dns.nic.accountant. 156.154.157.195

; <<>> DiG 9.10.1 <<>> @156.154.157.195 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

>>> ns5.dns.nic.accountant. 2610:a1:1075::c3

; <<>> DiG 9.10.1 <<>> @2610:a1:1075::c3 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56808
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;_443._tcp.accountant. IN TLSA

;; AUTHORITY SECTION:
accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189
900 900 604800 86400

;; Query time: 13 msec
;; SERVER: 2610:a1:1075::c3#53(2610:a1:1075::c3)
;; WHEN: Wed May 27 15:51:12 EDT 2015
;; MSG SIZE  rcvd: 108


>>> ns6.dns.nic.accountant. 156.154.158.195

; <<>> DiG 9.10.1 <<>> @156.154.158.195 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

>>> ns6.dns.nic.accountant. 2610:a1:1076::c3

; <<>> DiG 9.10.1 <<>> @2610:a1:1076::c3 _443._tcp.accountant. TLSA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40030
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;_443._tcp.accountant. IN TLSA

;; AUTHORITY SECTION:
accountant. 7200 IN SOA ns1.dns.nic.accountant. hostmaster.neustar.biz. 189
900 900 604800 86400

;; Query time: 1 msec
;; SERVER: 2610:a1:1076::c3#53(2610:a1:1076::c3)
;; WHEN: Wed May 27 15:51:27 EDT 2015
;; MSG SIZE  rcvd: 108

-- 
Shumon Huque
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20150527/d821c582/attachment.html>

More information about the dns-operations mailing list