3 ms·
FWIW, after getting exactly the same output from `delv` locally, I noted that $ dig +short slack.com @4.2.2.1 15.206.34.128 and I take this to mean that,
by exikyut 5y ago
FWIW, after getting exactly the same output from `delv` locally, I noted that
$ dig +short slack.com @4.2.2.1
15.206.34.128
and I take this to mean that, despite failing DNSSEC, Level 3 is yielding an A record - and that the major players have basically monkey-patched this into working again, and it just needs to propagate through all the caches now?
- ArchOversight 5y agoNope, Level 3's DNS servers don't do DNSSEC validation, as can be tested with dig: % dig www.brokendnssec.net +dnssec @4.2.2.1 ; <<>> DiG 9.10.6 <<>> www.brokendnssec.net +dnssec @4.2.2.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58098 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 8192 ;; QUESTION SECTION: ;www.brokendnssec.net. IN A ;; ANSWER SECTION: www.brokendnssec.net. 300 IN A 104.22.35.212 www.brokendnssec.net. 300 IN A 172.67.36.129 www.brokendnssec.net. 300 IN A 104.22.34.212 ;; Query time: 84 msec ;; SERVER: 4.2.2.1#53(4.2.2.1) ;; WHEN: Thu Sep 30 17:59:35 MDT 2021 ;; MSG SIZE rcvd: 97 % dig www.brokendnssec.net +dnssec @8.8.8.8 ; <<>> DiG 9.10.6 <<>> www.brokendnssec.net +dnssec @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22514 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.brokendnssec.net. IN A ;; Query time: 96 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Sep 30 17:59:44 MDT 2021 ;; MSG SIZE rcvd: 49