5 ms·
You can test it at home using "delv www.slack.com @4.2.2.1 +rtrace" (4.2.2.[1-6] are Level 3's servers): ;; fetch: www.slack.com/A ;; fetch: com/DS
by madars 5y ago
You can test it at home using "delv www.slack.com @4.2.2.1 +rtrace" (4.2.2.[1-6] are Level 3's servers):
;; fetch: www.slack.com/A
;; fetch: com/DS
;; fetch: ./DNSKEY
;; fetch: slack.com/DS
;; fetch: com/DNSKEY
;; fetch: www.slack.com/DS
;; validating slack.com/SOA: got insecure response; parent indicates it should be secure
;; no valid RRSIG resolving 'www.slack.com/DS/IN': 4.2.2.1#53
;; broken trust chain resolving 'www.slack.com/A/IN': 4.2.2.1#53
;; resolution failed: broken trust chain
- exikyut 5y agoFWIW, after getting exactly the same output from `delv` locally, I noted that $ dig +short slack.com @4.2.2.1 15.206.34.128 and I take this to mean that, despite failing DNSSEC, Level 3 is yielding an A record - and that the major players have basically monkey-patched this into working again, and it just needs to propagate through all the caches now?
- ArchOversight 5y agoNope, Level 3's DNS servers don't do DNSSEC validation, as can be tested with dig: % dig www.brokendnssec.net +dnssec @4.2.2.1 ; <<>> DiG 9.10.6 <<>> www.brokendnssec.net +dnssec @4.2.2.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58098 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 8192 ;; QUESTION SECTION: ;www.brokendnssec.net. IN A ;; ANSWER SECTION: www.brokendnssec.net. 300 IN A 104.22.35.212 www.brokendnssec.net. 300 IN A 172.67.36.129 www.brokendnssec.net. 300 IN A 104.22.34.212 ;; Query time: 84 msec ;; SERVER: 4.2.2.1#53(4.2.2.1) ;; WHEN: Thu Sep 30 17:59:35 MDT 2021 ;; MSG SIZE rcvd: 97 % dig www.brokendnssec.net +dnssec @8.8.8.8 ; <<>> DiG 9.10.6 <<>> www.brokendnssec.net +dnssec @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22514 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.brokendnssec.net. IN A ;; Query time: 96 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Sep 30 17:59:44 MDT 2021 ;; MSG SIZE rcvd: 49
- mike-cardwell 5y agoYou can also just use dig. Running: `dig a www.slack.com` returns a SERVFAIL for me. Asking my resolver to skip the dnssec checking gives me the A record though: `dig +cd a www.slack.com` I then look at my unbound dns resolver logs: Sep 30 21:53:11 unbound[8985:0] info: validation failure <www.slack.com. A IN>: No DNSKEY record from 208.67.220.123 for key slack.com. while building chain of trust