1.7.1 qname-minimisation and Akamai?

[Petr Špaček]

On 11.6.2018 23:31, Håkan Lindqvist via Unbound-users wrote:
> Hi,
> 
> I ran into and issue where it appears that Unbound 1.7.1 fails to 
> resolve some Akamai CDN names if qname-minimisation is enabled 
> (consistently responds with SERVFAIL).
> 1.7.0 did not exhibit the same behavior with identical configuration.
> 
> A couple of example names: cdn.samsung.com <http://cdn.samsung.com>, 
> storeedgefd.dsx.mp.microsoft.com 
> <http://storeedgefd.dsx.mp.microsoft.com>  (eg "dig @unbound 
> cdn.samsung.com <http://cdn.samsung.com>")
> 
> With verbosity turned up, the log includes:
> debug: request has exceeded the maximum number of query restarts with 9
> debug: return error response SERVFAIL
> 
> It appears Unbound intentionally aborts, and the limits don't appear to 
> have changed since 1.7.0, but maybe the accounting has changed?
> (I'm not sure if the "Fix cname classification with qname minimisation 
> enabled." change could be related?)
> 
> I also ran across one other mention of what I believe is the same issue 
> at: 
> https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1608638.html
> 
> 
> Is this a straight up bug or is there some settings (other than 
> disabling qname-minimisation) that I just fail to find that can counter 
> this new behavior?
> 
> I find it a bit concerning since there's some very high profile 
> sites/services using the affected Akamai CDN (with their rather 
> enthusiastic CNAME usage) and that 1.7.2 apparently enables 
> qname-minisation by default.

I cannot comment on changes in Unbound, but ...

Have you tried to contact Amazon? What was their response?

Amazon notoriously breaks DNS standards and are not going to fix it 
until enough people complain. Please complain!

-- 
Petr Špaček  @  CZ.NIC