DNSSEC: bogus NSEC denial proofs on GoDaddy-signed zone webcracy.ch

[contact at webcracy.ch]

Hi all,

reporting a DNSSEC signing bug at GoDaddy (domaincontrol.com), in case 
others are seeing it or someone from GoDaddy is on the list. GoDaddy 
support has a very long queue right now; I'll open a case there as well 
and follow up here with the number.

I run Webcracy SNC from Switzerland and our sites are on GoDaddy DNS 
with GoDaddy-managed DNSSEC.

----

webcracy.ch is hosted on GoDaddy DNS (ns55/ns56.domaincontrol.com) with
GoDaddy-managed DNSSEC (ECDSAP256SHA256, NSEC). Validating resolvers
(1.1.1.1, 8.8.8.8, 9.9.9.9) return SERVFAIL for some names because the NSEC
records GoDaddy serves don't prove what they need to. Two separate cases:


1. Wildcard expansion proof uses the wrong NSEC

The zone has "*.webcracy.ch A". Names synthesized from the wildcard that 
sort
right after a "label / label-suffix" pair get an NSEC that does not 
cover the
queried name, so the wildcard answer is bogus.

To show it I created two test records, a pair of that shape:

   dnssec-test.webcracy.ch.    CNAME  webcracy.ch.
   dnssec-test-a.webcracy.ch.  CNAME  webcracy.ch.

   Fails:  dnssec-test-b.webcracy.ch, dnssec-z.webcracy.ch
           Cloudflare: EDE 6 (DNSSEC Bogus): wildcard expansion proof 
for dnssec-z.webcracy.ch.
   Works:  dnssec-a.webcracy.ch (same wildcard, sorts before the pair)

For dnssec-z.webcracy.ch the server returns

   dnssec-test.webcracy.ch. NSEC dnssec-test-a.webcracy.ch. CNAME RRSIG NSEC

which does not cover "dnssec-z"; the covering NSEC would start at
dnssec-test-a. It looks like the chain is sorted as plain text ("-" 
before ".")
instead of in canonical DNS order (RFC 4034 section 6.1).


2. NXDOMAIN below an empty non-terminal is missing the wildcard-denial NSEC

The zone has several records under _agents (e.g. _a2a._agents and
_index._agents SVCB, _catalog._agents TXT), so _agents.webcracy.ch is an 
empty
non-terminal. Queries for missing names under it, e.g.
_example._agents.webcracy.ch, return NXDOMAIN with only

   _catalog._agents.webcracy.ch. NSEC _index._agents.webcracy.ch. TXT 
RRSIG NSEC

There is no NSEC proving that *._agents.webcracy.ch doesn't exist, so
validators mark the answer bogus:

   EDE 6 (DNSSEC Bogus): proof of non-existence of 
_example._agents.webcracy.ch.


Reproduce

   dig @1.1.1.1 dnssec-z.webcracy.ch A             -> SERVFAIL
   dig @1.1.1.1 _example._agents.webcracy.ch A     -> SERVFAIL
   dig +cd @1.1.1.1 dnssec-z.webcracy.ch A         -> answers 
(validation off)

   DNSViz (both marked Bogus; rest of the chain is Secure):

   https://dnsviz.net/d/dnssec-z.webcracy.ch/dnssec/
     "No NSEC RR covers the SNAME (dnssec-z.webcracy.ch). See RFC 4035, 
Sec. 3.1.3.3."

   https://dnsviz.net/d/_example._agents.webcracy.ch/dnssec/
     "No NSEC RR covers the wildcard (*._agents.webcracy.ch). See RFC 
4035, Sec. 3.1.3.2."


Impact

Real subdomains served by the wildcard became unreachable for every
validating resolver. We worked around it by giving each subdomain an 
explicit
CNAME, but any customer with DNSSEC plus a wildcard can hit this.

Thanks,
Liam Giannini, Webcracy