<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">Last month or so I saw two domains, <a href="http://postnl.nl" class="">postnl.nl</a> and <a href="http://minjenv.nl" class="">minjenv.nl</a>, return incomplete NSEC3 records where existing records where omitted from the <span style="font-size: 13.333333015441895px;" class="">Type Bit Maps.</span></div><div class=""><span style="font-size: 13.333333015441895px;" class=""><br class=""></span></div><div class=""><font size="2" class="">This caused strange intermittent failures when a resolver was used that implements aggressive use of DNSSEC validated cache (RFC8198, 4 years old), e.g powerdns recursor 4.5.x. </font></div><div class=""><br class=""></div><div class=""><font size="2" class=""><br class=""></font></div><div class=""><font size="2" class="">e.g., the minjenv has a mx record, but it is not listed in the NSEC3 you’ll get if you query for the non existent A/AAAA record (only NS SOA RRSIG DNSKEY NSEC3PARAM</font><span style="font-size: small;" class="">) causing mail delivery failures until the TTL expires. <a href="http://postnl.nl" class="">postnl.nl</a> has A/AAAA, but the NSEC3 seen for a nonexistent query only has </span><font size="2" class="">NS SOA MX TXT RRSIG DNSKEY NSEC3PARAM</font></div><div class=""><font size="2" class=""><br class=""></font></div><div class=""><font size="2" class="">It is not as such to contact the dns operators and persuade them to upgrade/fix their software used for DNSSEC signing, but more as should we do more analysis of this phenomenon and even have a dns flag day before even more resolvers and operators are going to implement RFC8198? There might be an issue by deliberately exploiting this and make websites/mail unreachable.</font></div><div class=""><font size="2" class=""><br class=""></font></div><div class=""><font size="2" class="">Best regards,</font></div><div class=""><font size="2" class=""> Ruben</font></div><div class=""><font size="2" class=""><br class=""></font></div></body></html>