<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div>This is being addressed.</div>
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div><span>
<pre>-- <br></pre>
<div style="color: rgb(0, 0, 0);">Brian L. King (<a href="mailto:blk@godaddy.com" style="color: purple;">blk@godaddy.com</a>)</div>
<div style="color: rgb(0, 0, 0);">Senior Linux/DNS Systems Administrator, Go Daddy</div>
<div style="color: rgb(0, 0, 0);">AZ time zone (<a href="http://x.co/aztime">http://x.co/aztime</a>)</div>
<div style="color: rgb(0, 0, 0);">:wq!</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
</span></div>
<div><br>
</div>
<div>On Sun, 2019-12-01 at 14:55 -0500, Viktor Dukhovni wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<pre>[ This is still unresolved since the original post on Nov 24th, now at least</pre>
<pre> 289 affected TLSA RRsets in 255 domains. Updated details at:</pre>
<pre> </pre>
<a href="https://imrryr.org/~viktor/dnsviz/domaincontrol.com.html">
<pre>https://imrryr.org/~viktor/dnsviz/domaincontrol.com.html</pre>
</a>
<pre> ]</pre>
<pre><br></pre>
<pre>The NSEC3 denial of existence for the TLSA records of at least 202 MX hosts (in</pre>
<pre>178 domains) is bogus, because the QNAME (or sometimes the wildcard if the</pre>
<pre>qname is covered "by accident") is not covered by any NSEC3 RR. In the below</pre>
<pre>example (RRSIGs elided), the sole NSEC3 RR only covers the zone apex:</pre>
<pre><br></pre>
</blockquote>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<pre>[snip]</pre>
</blockquote>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<pre>--</pre>
<pre> Viktor.</pre>
</blockquote>
</body>
</html>