<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Does anyone care about this? Who has tried to retrieve the TLSA
record of elstel.com via libunbound? Why does it not return the
TLSA record as unsafe if it is present but not signed correctly?<br>
</p>
<div class="moz-cite-prefix">Am 11.02.20 um 14:51 schrieb Elmar
Stellnberger:<br>
</div>
<blockquote type="cite"
cite="mid:ab17308b-b600-3436-6710-2e0b814252a0@gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
Currently libunbound returns no data if no correct RRSIG can be
found as is currently the case for the domain elstel.com.<br>
Would anyone mind to change libunbound so that it returns the
existent TLSA record as insecure data?<br>
<pre>$ ./drill_TLSA elstel.com
_443._tcp.elstel.com. 3600 IN TLSA 3 0 1 a8edf0cacaf776acacdfe53564c51556ad325f03a369e4c8f4622b4dc5b06865</pre>
<pre class="moz-quote-pre" wrap="">$ ./dig_TLSA elstel.com
ns name: 198.41.0.4
ns name: 199.9.14.201
ns name: 192.33.4.12
ns name: 199.7.91.13
ns name: 192.203.230.10
ns name: 192.5.5.241
ns name: 192.112.36.4
ns name: 198.97.190.53
ns name: 192.36.148.17
ns name: 192.58.128.30
ns name: 193.0.14.129
ns name: 199.7.83.42
ns name: 202.12.27.33
Launch a query to find a RRset of type TLSA for zone:
_443._tcp.elstel.com with nameservers:
. 518400 IN NS a.root-servers.net.
. 518400 IN NS b.root-servers.net.
. 518400 IN NS c.root-servers.net.
. 518400 IN NS d.root-servers.net.
. 518400 IN NS e.root-servers.net.
. 518400 IN NS f.root-servers.net.
. 518400 IN NS g.root-servers.net.
. 518400 IN NS h.root-servers.net.
. 518400 IN NS i.root-servers.net.
. 518400 IN NS j.root-servers.net.
. 518400 IN NS k.root-servers.net.
. 518400 IN NS l.root-servers.net.
. 518400 IN NS m.root-servers.net.
no response but there is a delegation in authority section:com.
Launch a query to find a RRset of type DNSKEY for zone: .
;; DNSKEYset:
. 172800 IN DNSKEY 257 3 8
AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN R1AkUTV74bU=
. 172800 IN DNSKEY 256 3 8
AwEAAeN+h0loXPKt7lFdW2zKIDkVHyJ1aYGUVE1dMNBlRH3kTn40JKcH
iPOs+fy0OFVCBwoKa1s9qZtdyP1UC0hgKoldj3oELK1yLI5MUbTMcNkW
bBMRuxRz/CgZJu3IxcmuZWZMbn4LQDMj5YeiUiuWns5vipFGWWpyPyoz
QXmenSWOK2GJOwcm7I/DyHVtVdztTvqiHqzy2aRoxwPhmEuAoYzzuNJJ
w6JNEnXaN/7l2TIciskFyPVPBFZYHnk+1ma906dfehIR190z3lh1ZESL
2Yy3VIE2QGpRU6Px4ydH5sXxZ2wSMgqNNga4kjnfM1msBqk3EI48RvTT kuV0yb1eFuU=
;; RRSIG of the DNSKEYset:
. 172800 IN RRSIG DNSKEY 8 0 172800 20200221000000 20200131000000
20326 . a90QZixKr3vHcfbornzE7Dl/z75m1+OnTI3qdU2misnifW9xv/ja4uoq
ixo59yPLBFRYmQDZntId14xcz/sZbo6XSzhJ2EaSm5WBotq9d1K9LaSa
tD1IYLoLKPfhxVcgo0fqz6h8Cdrzb/nHeo4xn/dm+RK03Wcx8n0UPc/Q
iXiHsf6uFAjarWm3PrJi0iRhXPKxfjgqbRhJy2knmAM04ZUimN2gpSz2
Oc23CsO/JD2hAO/x8b+TgtD9D/Y4Twa1kIeVbdxHNxJOY0x9/H4UbcHv
/iFcyB4CLp18QC8ZDBJpIR1EAvCZNTQ3xkeYDiP5nIMn5z4h+eaK4hE6 VqwcfA==
;; chain of trust can't be validated: FAILED
;; cleanandgo</pre>
</blockquote>
</body>
</html>