Some sites not resolving (DNSSEC?)

[Petr Špaček]

On 23.5.2018 15:58, Petr Špaček via Unbound-users wrote:
> On 23.5.2018 15:46, W.C.A. Wijngaards via Unbound-users wrote:
>> Hi Hank,
>>
>> On 23/05/18 15:23, Hank Barta via Unbound-users wrote:
>>> Hi all,
>>> I use pfsense for my firewall and have selected the unbound resolver for
>>> DNS on my home LAN. I have configured this to use Cloudflare DNS with
>>> DNSSEC enabled.  In addition to checking the "Enable DNSSEC Support"
>>> checkbox on the DNS Resolver configuration page I have added the custom
>>> options
>>
>> The 1.1.1.1 server responds without DNSSEC for coder.show DS queries.
>> And for an insecure referral it needs DS denial information for type DS,
>> eg. the NSEC or NSEC3 from the .show TLD.
>>
>> Without the forward to 1.1.1.1 it works fine for me.  So it doesn't seem
>> to be the .show TLD or coder.show site, but the 1.1.1.1 unsigned CNAME
>> for qtype DS.
>>
>> A workaround is domain-insecure: "coder.show" in unbound.conf
> 
> This is most likely a bug in Knot Resolver and we are working on fix:
> https://gitlab.labs.nic.cz/knot/knot-resolver/issues/359

For the record:
We found out that domain coder.show is misconfigured in a way which 
breaks even 30 years old DNS standards.

See this:

$ dig +dnssec @ns2.hover.com. coder.show DS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50641
;; flags: qr rd; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0

;; QUESTION SECTION:
;coder.show.			IN	DS

;; ANSWER SECTION:
coder.show.		900	IN	CNAME	hosted.fireside.fm.


$ dig +dnssec @ns2.hover.com. coder.show NS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24968
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;coder.show.			IN	NS

;; ANSWER SECTION:
coder.show.		900	IN	NS	ns2.hover.com.
coder.show.		900	IN	NS	ns1.hover.com.


I.e. this domain has CNAME at the apex which is violation of DNS 
standards, namely
https://tools.ietf.org/html/rfc1034#section-3.6.2

Please contact domain owner and ask for a fix. (It seems that all the 
domains mentioned in the ticket have the same issue.)

It might work elsewhere but this is not guaranteed (i.e. works 
accidentally).

Thank you for understanding.

-- 
Petr Špaček  @  CZ.NIC