[dns-operations] broken 'apex' NSEC3 for ma. denies big number of delegated names

[Viktor Dukhovni]

On Tue, Oct 06, 2026 at 01:07:19AM +1100, Viktor Dukhovni wrote:

> > This problem has recurred (or still persists).
> 
> Confirmed, the NSEC3 RR matching the zone apex is much too broad,
> implausibly covering a large fraction of the hash space.  The "TEST" in
> the "4TEST..." next hash is an interesting coincidence if it is one...

Still present, non-recursive direct queries[1] to the "c.tld.ma" auth
server return:

    $ hsdig -R -n c.tld.ma --nocrypto -Dt SRV ma.
    ; NOERROR qr aa do
    ma. IN SRV ?
    ma. IN SOA c.tld.ma. ma.anrt.ma. 2039673474 900 90 604800000 1800
    ma. IN RRSIG SOA 8 1 108000 20261105030441 20261006020441 28354 ma. [omitted]
    MFB8BPVI7H18DJ77DCIKCMDJGHII3D5B.ma. IN NSEC3 1 0 10 4f6e444c70554fbafbb2 4TESTIB4CP7V1199LBC5JAUG3FG5L7BM NS SOA RRSIG DNSKEY NSEC3PARAM
    MFB8BPVI7H18DJ77DCIKCMDJGHII3D5B.ma. IN RRSIG NSEC3 8 2 1800 20261031124548 20261001114548 28354 ma. [omitted]

-- 
    Viktor.  🇺🇦 Слава Україні!

[1] "hsdig" is an unpublished CLI based on the Haskell "dnsbase" stub
resolver library.