[dns-operations] Strange behavior of covid.cdc.gov

[Stephane Bortzmeyer]

On Mon, Aug 31, 2020 at 10:12:04PM +0900,
 Yasuhiro Orange Morishita / 森下泰宏 <yasuhiro at jprs.co.jp> wrote 
 a message of 18 lines which said:

> But it seems to be a little bit strange.  The auth servers of cdc.gov
> zone serve unneed (and unsigned) akam.cdc.gov zone.  But they still
> have DS RR for real akam.cdc.gov zone.

They also do not return a proper delegation:

% dig +dnssec +norec @icdc-us-ns2.cdc.gov. A akam.cdc.gov 
; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> +dnssec +norec @icdc-us-ns2.cdc.gov. A akam.cdc.gov
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43497
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 70d47b392dfb22d2662352815f4d0d3fe1c90df99f508386 (good)
;; QUESTION SECTION:
;akam.cdc.gov.		IN A

;; AUTHORITY SECTION:
akam.cdc.gov.		3600 IN	SOA a1-43.akam.net. adhelpdsk.cdc.gov. (
				612558384  ; serial
				300        ; refresh (5 minutes)
				180        ; retry (3 minutes)
				1209600    ; expire (2 weeks)
				3600       ; minimum (1 hour)
				)

;; Query time: 98 msec
;; SERVER: 198.246.96.92#53(198.246.96.92)
;; WHEN: Mon Aug 31 16:46:23 CEST 2020
;; MSG SIZE  rcvd: 129

% dig +dnssec +norec @icdc-us-ns2.cdc.gov. DNSKEY akam.cdc.gov
; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> +dnssec +norec @icdc-us-ns2.cdc.gov. DNSKEY akam.cdc.gov
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44336
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 2e27a9b171983390a21696a65f4d0d54710de953e8dd107b (good)
;; QUESTION SECTION:
;akam.cdc.gov.		IN DNSKEY

;; AUTHORITY SECTION:
akam.cdc.gov.		3600 IN	SOA a1-43.akam.net. adhelpdsk.cdc.gov. (
				612558384  ; serial
				300        ; refresh (5 minutes)
				180        ; retry (3 minutes)
				1209600    ; expire (2 weeks)
				3600       ; minimum (1 hour)
				)

;; Query time: 98 msec
;; SERVER: 198.246.96.92#53(198.246.96.92)
;; WHEN: Mon Aug 31 16:46:44 CEST 2020
;; MSG SIZE  rcvd: 129

Whuch may explain the strange error messages of DNSviz (the IP
addresses are for the parent zone).