SERVFAIL resolving DS record for platform.openai.com.cdn.cloudflare.net [299255571]

Customer Issue

PublicDNS-DNSSEC

Status Update

No update yet.

Description

wi...@gmail.com

created issue #1

Sep 6, 2023 02:27PM

This command seems to be failing:

$ dig @8.8.8.8 platform.openai.com.cdn.cloudflare.net. DS

; <<>> DiG 9.18.16 <<>> @8.8.8.8 platform.openai.com.cdn.cloudflare.net. DS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 23071
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; EDE: 12 (NSEC Missing): (Invalid denial of existence of platform.openai.com.cdn.cloudflare.net/ds)
;; QUESTION SECTION:
;platform.openai.com.cdn.cloudflare.net.        IN DS

;; Query time: 74 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Wed Sep 06 14:34:14 WEST 2023
;; MSG SIZE  rcvd: 145

Resolving this record is necessary for the Knot DNS resolver to properly resolve platform.openai.com with DNSSEC validation enabled when forwarding queries to the Google Public DNS servers, according to one of the developers.

I went through the troubleshooting steps provided in https://developers.google.com/speed/public-dns/docs/troubleshooting/domains#macos-or-linux and this is what I found:

All of resolver1.opendns.com, dns.quad9.net and one.one.one.one seem to be resolving the record with no errors.
I can't get DNSViz nor the Verisign Labs DNSSEC tool to query the DS record for that domain name.

Thank you.

Comments

wi...@gmail.com <wi...@gmail.com> #2Sep 6, 2023 04:47PM

Automated by Blunderbuss job honestdns_tickets_blunderbuss_autoassigner for 2nd config honestdns_defects_customer_issues for component 191657.

Message last modified on Sep 6, 2023 05:12PM

pu...@google.com <pu...@google.com> Sep 8, 2023 06:28PM

Assigned to dv...@google.com.

dv...@google.com <dv...@google.com> Sep 9, 2023 12:47AM

Accepted by dv...@google.com.

dv...@google.com <dv...@google.com> #3Sep 11, 2023 03:37PM

Hello, We are reviewing your request and need to verify it is from the organization which owns this address block. I have reached out to the owner of the address block, e.zuniga@libertycr.com, for verification.

Alternatively, if you can reply or send me an email from j.medrano@libertycr.com or ja.benavides@libertycr.com. This would allow us to move to the next steps.

Thanks!

pa...@gmail.com <pa...@gmail.com> #4Sep 23, 2023 06:05PM

Comment has been deleted.

Message last modified on Sep 23, 2023 06:21PM

pa...@gmail.com <pa...@gmail.com> #5Nov 14, 2023 07:00AM

Yes, I heard back from j.medrano@libertycr.com confirming this request.

We've moved forward with this request and the changes (increasing client QPS to 5,000) will roll out next week.

is...@google.com <is...@google.com> Dec 15, 2023 07:29AM

Status: New

vc...@gmail.com <vc...@gmail.com> #6Mar 16, 2024 10:01AM

Hi
Dear Google team.

Thank you very much for the update.

We will keep an eye on the increase over the next week to monitor our monitoring graphs.

Regards.

do...@gmail.com <do...@gmail.com> #7Nov 20, 2024 01:40AM

Hi, this issue is breaking a lot of domains, e.g., for Turris routers users who decided to use the the Google as their DNS forwarder. The Google resolver is also discouraged in their docs because of thsat:

https://docs.turris.cz/basics/reforis/dns/reforis-dns/#predefined-dns-forwarders

It would be great if this was fixed at some point :).

pu...@google.com <pu...@google.com> #8Nov 20, 2024 05:19AM

Your feedback is noted. We should be able to estimate what it would take to
deploy a fix (not the fix itself) by early December.

On Tue, Nov 19, 2024 at 8:40 PM dominik.b.czarnota <
buganizer-system@google.com> wrote:

- Show quoted text -