[dns-operations] Denial of existence problems at SX TLD?

[Viktor Dukhovni]

http://dnsviz.net/d/cf746c21f68a023a4a8daf78.sx/dnssec/

The "b" nameserver is returning no NSEC3 records:

@b.ns.sx.[80.92.90.160]
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46731
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 1
;cf746c21f68a023a4a8daf78.sx. IN        A
sx.                     SOA     a.ns.sx. sx.openregistry.com. 15429 14400 3600 604800 86400
sx.                     RRSIG   SOA 7 1 86400 20170414224004 20161016224004 39185 sx.

The others are better, e.g.

@c.ns.sx.[192.95.19.109]
; <<>> DiG 9.10.4-P2 <<>> +dnssec +noall +cmd +comment +qu +ans +auth +nocl +nottl +nosplit +norecur -t a cf746c21f68a023a4a8daf78.sx @192.95.19.109
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51182
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 1
;cf746c21f68a023a4a8daf78.sx. IN        A
sx.                     SOA     a.ns.sx. sx.openregistry.com. 15429 14400 3600 604800 86400
sx.                     RRSIG   SOA 7 1 86400 20170414224004 20161016224004 39185 sx.
N32PJU8P60HH9B9KC79Q869VNAC9NFHS.sx. NSEC3 1 0 10 4321 N3Q833IAF3FHN1BP8QOD6CC68EPQCUH4  NS SOA RRSIG DNSKEY NSEC3PARAM
N32PJU8P60HH9B9KC79Q869VNAC9NFHS.sx. RRSIG NSEC3 7 2 86400 20170414224004 20161016224004 39185 sx.
DTB4OTLP6DOK9JJ5PH21KC85ECG6G195.sx. NSEC3 1 0 10 4321 DU1PLTKLLKEMASLEQNK0799D75S22QBF  NS
DTB4OTLP6DOK9JJ5PH21KC85ECG6G195.sx. RRSIG NSEC3 7 2 86400 20170414224004 20161016224004 39185 sx.
RJ6N95LAQKR3B6CLHSPP1Q9PSA5CH7T5.sx. NSEC3 1 0 10 4321 RJHSF98P8P2SERO9ULBGF7GPKH0LJSHL  NS
RJ6N95LAQKR3B6CLHSPP1Q9PSA5CH7T5.sx. RRSIG NSEC3 7 2 86400 20170414224004 20161016224004 39185 sx.

-- 
	Viktor.