<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 30, 2020, at 1:46 PM, Brian Dickson <<a href="mailto:brian.peter.dickson@gmail.com" class="">brian.peter.dickson@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hi, Victor,<div class="">Would you mind checking the list for domains with broken signed delegations to anything matching *.<a href="http://domaincontrol.com/" class="">domaincontrol.com</a> (GoDaddy's nameservers), including categorization (e.g. lame NS, vs non-lame NS with broken signature)?</div><div class="">My suspicion is there may be a bunch of lame delegations, and knowing which TLDs (and if possible domains!) would be greatly appreciated.</div><div class="">Cleaning up lame delegations is neither easy nor fast, but we do want to actually clean them up.</div><div class=""><br class=""></div></div></div></blockquote><div><br class=""></div>HI Victor,</div><div>Thanks for bringing this up. </div><div><br class=""></div><div>Can you send me the list for domains under <a href="http://ns.cloudflare.com" class="">ns.cloudflare.com</a> </div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">(The root issue is there is currently no path for the delegatee to get the lame delegation removed. None. Nada. :-( )</div><div class=""><br class=""></div></div></div></blockquote><br class=""></div><div><br class="">CDS was supposed to address this but as you say it does not work when domain becomes lame or when operator is changed w/o removing/updating the old DS records. </div><div><br class=""></div><div>There are many reasons why a domain can go lame including other that the domain is kicked off a system for non-payment, policy violations, etc.</div><div><br class=""></div><div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">Thanks,</div><div class="">Brian</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 29, 2020 at 10:59 PM Viktor Dukhovni <<a href="mailto:ietf-dane@dukhovni.org" class="">ietf-dane@dukhovni.org</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I have a list of ~69k domain names with extant DS RRsets, where the<br class="">
DNSKEY RRset has been either unavailable or failing validation for 180<br class="">
days or more (92k domains if the bar is set to 90 days). These span 439<br class="">
TLDs! Of these domains, ~30k are simply lame and zone apex NS lookups<br class="">
fail even with CD=1. The remaining ~39k likely have DNSSEC-specific<br class="">
misconfiguration.<br class="">
<br class=""></blockquote></div></div></blockquote><div>The question that needs to be asked is this 69K number unreasonable ?</div><div class=""><br class=""></div><div>There are many reasons why a domain can go lame including other that the domain is kicked off a system for non-payment, policy violations, etc. </div><div>As for the DNSSEC-specific misconfigurations there are probably two main reasons </div><div>a) Signing not working </div><div>b) Automated key rollover not reflected in DS </div><div><br class=""></div><div>A interesting question is how many of those “problems” are solved when the domain registration expires ? </div><div>Or the converse question have any of those domains been renewed in the last 180 days ? </div><div>which brings up another question does the TLD make a difference on renewal of lame domains ?</div><div><br class=""></div><div>Olafur</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
The top 25 TLDs by count of long-term dead signed delegations are:<br class="">
<br class="">
24742 com<br class="">
9258 nl<br class="">
5357 se<br class="">
4553 cz<br class="">
2897 net<br class="">
2763 eu<br class="">
2044 pl<br class="">
1661 org<br class="">
1070 no<br class="">
1035 hu<br class="">
992 fr<br class="">
916 nu<br class="">
731 uk<br class="">
701 info<br class="">
594 be<br class="">
562 ch<br class="">
557 xyz<br class="">
552 de<br class="">
421 es<br class="">
349 sk<br class="">
346 dk<br class="">
321 app<br class="">
282 io<br class="">
250 biz<br class="">
240 pt<br class="">
<br class="">
If any of the TLDs have policies that allow the deadwood to be delisted<br class="">
(still registered, but not delegated) I can provide the list of<br class="">
domains... It would be nice to see less breakage in the live zones.<br class="">
<br class="">
-- <br class="">
Viktor.<br class="">
_______________________________________________<br class="">
dns-operations mailing list<br class="">
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank" class="">dns-operations@lists.dns-oarc.net</a><br class="">
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank" class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br class="">
</blockquote></div>
_______________________________________________<br class="">dns-operations mailing list<br class=""><a href="mailto:dns-operations@lists.dns-oarc.net" class="">dns-operations@lists.dns-oarc.net</a><br class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br class=""></div></blockquote></div><br class=""></body></html>