[dns-operations] DNSSEC validation - salliemae.com

[Viktor Dukhovni]

On Wed, Aug 07, 2019 at 09:25:40AM -0400, Robert Blayzor wrote:

> We run multiple unbound recursive DNS servers using DNSSEC validation.
> 
> We've been getting complaints about users not being able to get to
> salliemae.com. From what we have seen, salliemae.com's DNSSEC is
> completely broken. Bad sigs, no sigs on records, etc.

Not completely, the DNSKEY RRset appears to validate fine, but the SOA
signatuer is broken (perhaps serial bumped after signing?), and so
all denial of existence fails:

    http://imrryr.org/~viktor/dnsviz/salliemae.com.d/xxx.salliemae.com.html

On the other hand, www.salliemae.com for which a CNAME does exist, mostly
works, though one of the nameservers doesn't bother returning any RRSIGs:

    http://imrryr.org/~viktor/dnsviz/salliemae.com.d/www.salliemae.com.html

> Who is right?

Though my unbound resolves their "www", their DNS is noticeably
flakey.  It'd be greate if someone would ping their operations team.

-- 
	Viktor.