[dns-operations] Incomplete NSEC3 denial of existence from domaincontrol.com servers

[Viktor Dukhovni]

The NSEC3 denial of existence for the TLSA records of at least 202 MX hosts (in
178 domains) is bogus, because the QNAME (or sometimes the wildcard if the
qname is covered "by accident") is not covered by any NSEC3 RR.  In the below
example (RRSIGs elided), the sole NSEC3 RR only covers the zone apex:

    @pdns05.domaincontrol.com.[97.74.110.52]
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55506
    ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
    ;_25._tcp.nightlifeinbangkok.com. IN TLSA
    nightlifeinbangkok.com. SOA     pdns05.domaincontrol.com. dns.jomax.net. 2019110901 28800 7200 604800 600
    kd5lt0sl1v8e2r1eoib3alo9iu417871.nightlifeinbangkok.com. NSEC3 1 0 1 - KR3PBJU1KUHPUCPBBVANN5QJKTE3ARN0 A NS SOA TXT RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY

    @pdns06.domaincontrol.com.[173.201.78.52]
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 59032
    ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
    ;_25._tcp.nightlifeinbangkok.com. IN TLSA
    nightlifeinbangkok.com. SOA     pdns05.domaincontrol.com. dns.jomax.net. 2019110901 28800 7200 604800 600
    kd5lt0sl1v8e2r1eoib3alo9iu417871.nightlifeinbangkok.com. NSEC3 1 0 1 - KR3PBJU1KUHPUCPBBVANN5QJKTE3ARN0 A NS SOA TXT RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY

    Relevant hashes:
    9km4c75r7bndmh1l33fucm7sdsqj6jef. _25._tcp.nightlifeinbangkok.com
    9mlqhb5pmr7f1o7goeqk04dl1ijqttlo. *._tcp.nightlifeinbangkok.com
    ak4novl0963d2t45t9olk5g5duimgb79. _tcp.nightlifeinbangkok.com
    sm7p33mq969iuo1d3fq454je1ofjh2v4. *.nightlifeinbangkok.com
    kd5lt0sl1v8e2r1eoib3alo9iu417871. nightlifeinbangkok.com

All 202 TLSA qnames with DNSViz graphs at:

    https://imrryr.org/~viktor/dnsviz/domaincontrol.com.html

The mname frequencies from the SOA RR are:

    21 pdns01.domaincontrol.com.
    25 pdns03.domaincontrol.com.
    39 pdns05.domaincontrol.com.
    36 pdns07.domaincontrol.com.
    14 pdns09.domaincontrol.com.
    48 pdns11.domaincontrol.com.
    19 pdns13.domaincontrol.com.

-- 
    Viktor.