[Pdns-users] DNSSEC and CNAME records results NXDOMAIN

Marijn marijn at egogo.nl
Fri Apr 22 17:18:23 UTC 2022


I fill the records with the API.
However when I check the SOA file (see below) it looks correct 
(hostmaster.egogo.eu).
But with "dig @ns1.mijn.host. autodiscover.egogo.eu" it shows an 
incorrect value.

MariaDB [powerdns]> SELECT * FROM domains WHERE id = 9644;
+------+----------+--------+------------+--------+-----------------+---------+
| id   | name     | master | last_check | type   | notified_serial | 
account |
+------+----------+--------+------------+--------+-----------------+---------+
| 9644 | egogo.eu |        |       NULL | MASTER |      1650634625 |     
     |
+------+----------+--------+------------+--------+-----------------+---------+
1 row in set (0.00 sec)

MariaDB [powerdns]> SELECT * FROM records WHERE domain_id = 9644;
+---------+-----------+------------------------+-------+---------------------------------------------------------------------+------+------+----------+---------------+------+
| id      | domain_id | name                   | type  | content         
                                                     | ttl  | prio | 
disabled | ordername     | auth |
+---------+-----------+------------------------+-------+---------------------------------------------------------------------+------+------+----------+---------------+------+
| 7909392 |      9644 | egogo.eu               | NS    | ns1.mijn.host   
                                                     | 3600 |    0 |      
   0 |               |    1 |
| 7909393 |      9644 | egogo.eu               | NS    | ns2.mijn.host   
                                                     | 3600 |    0 |      
   0 |               |    1 |
| 7909394 |      9644 | egogo.eu               | NS    | ns3.mijn.host   
                                                     | 3600 |    0 |      
   0 |               |    1 |
| 7910921 |      9644 | autodiscover.egogo.eu  | CNAME | 
autodiscover.outlook.com                                            |  
900 |    0 |        0 | autodiscover  |    1 |
| 7910922 |      9644 | autodiscover2.egogo.eu | CNAME | egogo.nl        
                                                     |  900 |    0 |      
   0 | autodiscover2 |    1 |
| 7910923 |      9644 | *.egogo.eu             | A     | 54.36.54.239    
                                                     |  900 |    0 |      
   0 | *             |    1 |
| 7910924 |      9644 | egogo.eu               | MX    | mail.egogo.eu   
                                                     |  900 |   10 |      
   0 |               |    1 |
| 7910925 |      9644 | egogo.eu               | A     | 54.36.54.239    
                                                     |  900 |    0 |      
   0 |               |    1 |
| 7910926 |      9644 | egogo.eu               | SOA   | ns1.mijn.host 
hostmaster.egogo.eu 1650634625 10800 3600 604800 3600 | 3600 |    0 |    
     0 |               |    1 |
+---------+-----------+------------------------+-------+---------------------------------------------------------------------+------+------+----------+---------------+------+
9 rows in set (0.01 sec)

MariaDB [powerdns]> SELECT * FROM cryptokeys WHERE domain_id = 9644;
+------+-----------+-------+--------+-----------+--------------------------------------------------------------------------------------------------------------------+
| id   | domain_id | flags | active | published | content                
                                                                          
                    |
+------+-----------+-------+--------+-----------+--------------------------------------------------------------------------------------------------------------------+
| 9603 |      9644 |   257 |      1 |         1 | Private-key-format: 
v1.2
Algorithm: 13 (ECDSAP256SHA256)
PrivateKey: [HIDDEN]
  |
+------+-----------+-------+--------+-----------+--------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

MariaDB [powerdns]> SELECT * FROM domainmetadata WHERE domain_id = 9644;
+-------+-----------+--------------+---------+
| id    | domain_id | kind         | content |
+-------+-----------+--------------+---------+
| 28902 |      9644 | API-RECTIFY  | 1       |
| 28901 |      9644 | SOA-EDIT-API | EPOCH   |
+-------+-----------+--------------+---------+
2 rows in set (0.00 sec)

$ pdnsutil show-zone egogo.eu
This is a Master zone
Last SOA serial number we notified: 1650634625 == 1650634625 (serial in 
the database)
Metadata items:
	API-RECTIFY	1
	SOA-EDIT-API	EPOCH
Zone has NSEC semantics
keys:
ID = 9603 (CSK), flags = 257, tag = 14759, algo = 13, bits = 256	  
Active	 Published  ( ECDSAP256SHA256 )
CSK DNSKEY = egogo.eu. IN DNSKEY 257 3 13 [HIDDEN] ; ( ECDSAP256SHA256 )
DS = egogo.eu. IN DS 14759 13 1 bc33e7dfe6ad30a0744c5f238d6acb8f0ffdfbd3 
; ( SHA1 digest )
DS = egogo.eu. IN DS 14759 13 2 
5b575f4eb351432995808a5c5a5e94d7459760c315248a344ec63c1f273c52f3 ; ( 
SHA256 digest )
DS = egogo.eu. IN DS 14759 13 4 
559f28bb6bf445611ddfc34d1c590f784c9472a6ff1a2adae36225c0f597343ce318990ed86531d49bfdad0e35fef6b0 
; ( SHA-384 digest )


$ pdnsutil list-zone egogo.eu
$ORIGIN .
*.egogo.eu	900	IN	A	54.36.54.239
autodiscover.egogo.eu	900	IN	CNAME	autodiscover.outlook.com.
autodiscover2.egogo.eu	900	IN	CNAME	egogo.nl.
egogo.eu	900	IN	A	54.36.54.239
egogo.eu	900	IN	MX	10 mail.egogo.eu.
egogo.eu	3600	IN	NS	ns1.mijn.host.
egogo.eu	3600	IN	NS	ns2.mijn.host.
egogo.eu	3600	IN	NS	ns3.mijn.host.
egogo.eu	3600	IN	SOA	ns1.mijn.host hostmaster.egogo.eu 1650634625 10800 
3600 604800 3600


Klaus Darilion via Pdns-users schreef op 2022-04-22 18:59:
> And how do you fill records into the mysql db? Can you show the
> relevenat rows of the records and domains table?
> regards
> Klaus
> 
>> -----Ursprüngliche Nachricht-----
>> Von: Pdns-users <pdns-users-bounces at mailman.powerdns.com> Im
>> Auftrag von Marijn via Pdns-users
>> Gesendet: Freitag, 22. April 2022 18:54
>> An: pdns-users at mailman.powerdns.com
>> Betreff: Re: [Pdns-users] DNSSEC and CNAME records results NXDOMAIN
>> 
>> I have pdnsutil 4.5.4 running with MySQL backend and native MySQL
>> replication.
>> 
>> In pdns.conf I have the following value. Maybe the @ doesn't work?
>> 
>> default-soa-content=ns1.mijn.host hostmaster.@ 0 10800 3600 604800 
>> 3600
>> 
>> Klaus Darilion schreef op 2022-04-22 18:06:
>> > I do not see any difference of the two cases. But in any case,
>> > returning an answer AND nxdomain is just broken.
>> >
>> >
>> > # dig @ns1.mijn.host. autodiscover.egogo.eu
>> > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 62514
>> > ...
>> > ;; QUESTION SECTION:
>> > ;autodiscover.egogo.eu.         IN      A
>> >
>> > ;; ANSWER SECTION:
>> > autodiscover.egogo.eu.  900     IN      CNAME
>> > autodiscover.outlook.com.
>> >
>> > ;; AUTHORITY SECTION:
>> > .                       3600    IN      SOA     ns1.mijn.host.
>> > hostmaster. 1643556361 10800 3600 604800 3600
>> >
>> > this is a very broken setup. SOA reports "." = root zone.
>> >
>> > which pdns version/backend/ zone setup are you using?
>> >
>> > regards
>> > Klaus
>> >
>> >> -----Ursprüngliche Nachricht-----
>> >> Von: Pdns-users <pdns-users-bounces at mailman.powerdns.com> Im
>> >> Auftrag von Marijn via Pdns-users
>> >> Gesendet: Freitag, 22. April 2022 16:39
>> >> An: pdns-users at mailman.powerdns.com
>> >> Betreff: [Pdns-users] DNSSEC and CNAME records results NXDOMAIN
>> >>
>> >> I have PowerDNS 4.5.1 running.
>> >>
>> >> DNSSEC is working on the domain:
>> >> https://dnssec-analyzer.verisignlabs.com/egogo.eu
>> >>
>> >> ---
>> >>
>> >> But when I have DNSSEC active and I create a CNAME record, which
>> >> doesn't
>> >> have DNSSEC, I get a NXDOMAIN error.
>> >>
>> >> ```
>> >> $ dig CNAME autodiscover.egogo.eu +short
>> >> autodiscover.outlook.com.
>> >> ```
>> >>
>> >> Here you can see the error
>> >> https://dnssec-analyzer.verisignlabs.com/autodiscover.egogo.eu
>> >>
>> >> - Zone egogo.eu (83.96.241.95) returns NXDOMAIN for
>> >> autodiscover.egogo.eu
>> >> - No NSEC records in response
>> >>
>> >> ---
>> >>
>> >> When I create a CNAME record to a domain with DNSSEC, it's working.
>> >> ```
>> >> $ dig CNAME autodiscover2.egogo.eu +short
>> >> egogo.nl.
>> >> ```
>> >> https://dnssec-analyzer.verisignlabs.com/autodiscover2.egogo.eu
>> >> - No errors
>> >>
>> >> ---
>> >>
>> >> Why is DNSSEC not working with CNAME record
>> autodiscover.outlook.com?
>> >> Or could there be something wrong in my configuration?
>> >> _______________________________________________
>> >> Pdns-users mailing list
>> >> Pdns-users at mailman.powerdns.com
>> >> https://mailman.powerdns.com/mailman/listinfo/pdns-users
>> _______________________________________________
>> Pdns-users mailing list
>> Pdns-users at mailman.powerdns.com
>> https://mailman.powerdns.com/mailman/listinfo/pdns-users
> _______________________________________________
> Pdns-users mailing list
> Pdns-users at mailman.powerdns.com
> https://mailman.powerdns.com/mailman/listinfo/pdns-users


More information about the Pdns-users mailing list