Resolving of nonexistant DS record produces wrong ServFail [188433824]

Customer Issue

Status Update

No update yet.

Description

ri...@gmail.com

created issue #1

May 18, 2021 04:19PM

On many queries I have tried for a DS record that does not exist, within a secure zone, Google DNS seems to produce ServFail. This prevents DNSSEC validating clients that want to confirm non-existence of a secure delegation from doing so. Some examples:

dig -t ds www.internetsociety.org @8.8.8.8 +dnssec
dig -t ds www.dnssec-tools.org @8.8.8.8 +dnssec

Comments

ha...@gmail.com <ha...@gmail.com> #2May 18, 2021 04:23PM

Automated by Blunderbuss job honestdns_tickets_blunderbuss_autoassigner for 2nd config honestdns_defects_customer_issues for component 191657.

Message last modified on May 18, 2021 04:24PM

mn...@gmail.com <mn...@gmail.com> #3May 18, 2021 04:26PM

Hello, We are reviewing your request and need to verify it is from the organization which owns this address block. I have reached out to the owner of the address block, e.zuniga@libertycr.com, for verification.

Alternatively, if you can reply or send me an email from j.medrano@libertycr.com or ja.benavides@libertycr.com. This would allow us to move to the next steps.

Thanks!

pu...@google.com <pu...@google.com> #4May 18, 2021 07:00PM

Hello

We have already answered the email with the mail j.medrano@libertycr.com

Thank you for contacting us.

Let's continue the process from the other email account.

Regards

ri...@gmail.com <ri...@gmail.com> #5May 18, 2021 08:26PM

Yes, I heard back from j.medrano@libertycr.com confirming this request.

We've moved forward with this request and the changes (increasing client QPS to 5,000) will roll out next week.

pu...@google.com <pu...@google.com> #6May 18, 2021 08:48PM

Hi
Dear Google team.

Thank you very much for the update.

We will keep an eye on the increase over the next week to monitor our monitoring graphs.

Regards.

ri...@gmail.com <ri...@gmail.com> #7May 18, 2021 09:03PM

OK. I don't have a good sense of the number who will be affected in domains they're actually trying to access. The potentially affected are at least all dnsmasq users with DNSSEC validation turned on and Google Public DNS as their upstream DNS provider, and maybe all users with any validating setup (not just dnsmasq) using Google as the upstream and not setting +cd bit, if the DS lookup is mandatory here, which I think it is.

Issue 188433824