[dns-operations] Strange behavior of covid.cdc.gov

[Mark Andrews]

Thankfully cdc.gov is also served by auth00.ns.uu.net and auth100.ns.uu.net
and they aren’t serving a incomplete version of akam.cdc.gov.  Recursive
servers will eventually get a valid referral rather than bogus (unsigned)
answers from ns[123].cdc.gov for akam.cdc.gov.

Mark

> On 1 Sep 2020, at 00:47, Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:
> 
> On Mon, Aug 31, 2020 at 10:12:04PM +0900,
> Yasuhiro Orange Morishita / 森下泰宏 <yasuhiro at jprs.co.jp> wrote 
> a message of 18 lines which said:
> 
>> But it seems to be a little bit strange.  The auth servers of cdc.gov
>> zone serve unneed (and unsigned) akam.cdc.gov zone.  But they still
>> have DS RR for real akam.cdc.gov zone.
> 
> They also do not return a proper delegation:
> 
> % dig +dnssec +norec @icdc-us-ns2.cdc.gov. A akam.cdc.gov 
> ; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> +dnssec +norec @icdc-us-ns2.cdc.gov. A akam.cdc.gov
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43497
> ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ; COOKIE: 70d47b392dfb22d2662352815f4d0d3fe1c90df99f508386 (good)
> ;; QUESTION SECTION:
> ;akam.cdc.gov.		IN A
> 
> ;; AUTHORITY SECTION:
> akam.cdc.gov.		3600 IN	SOA a1-43.akam.net. adhelpdsk.cdc.gov. (
> 				612558384  ; serial
> 				300        ; refresh (5 minutes)
> 				180        ; retry (3 minutes)
> 				1209600    ; expire (2 weeks)
> 				3600       ; minimum (1 hour)
> 				)
> 
> ;; Query time: 98 msec
> ;; SERVER: 198.246.96.92#53(198.246.96.92)
> ;; WHEN: Mon Aug 31 16:46:23 CEST 2020
> ;; MSG SIZE  rcvd: 129
> 
> % dig +dnssec +norec @icdc-us-ns2.cdc.gov. DNSKEY akam.cdc.gov
> ; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> +dnssec +norec @icdc-us-ns2.cdc.gov. DNSKEY akam.cdc.gov
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44336
> ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ; COOKIE: 2e27a9b171983390a21696a65f4d0d54710de953e8dd107b (good)
> ;; QUESTION SECTION:
> ;akam.cdc.gov.		IN DNSKEY
> 
> ;; AUTHORITY SECTION:
> akam.cdc.gov.		3600 IN	SOA a1-43.akam.net. adhelpdsk.cdc.gov. (
> 				612558384  ; serial
> 				300        ; refresh (5 minutes)
> 				180        ; retry (3 minutes)
> 				1209600    ; expire (2 weeks)
> 				3600       ; minimum (1 hour)
> 				)
> 
> ;; Query time: 98 msec
> ;; SERVER: 198.246.96.92#53(198.246.96.92)
> ;; WHEN: Mon Aug 31 16:46:44 CEST 2020
> ;; MSG SIZE  rcvd: 129
> 
> Whuch may explain the strange error messages of DNSviz (the IP
> addresses are for the parent zone).
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka at isc.org