Check My DNS incorrectly passing RPKI IPv6 when IPv6 is not available

[jkldgoefgkljefogeg]

RPKI IPv6 should not be marked as success if the client fails IPv6 transport, this is misleading

[jelu]

The RPKI check is about the traffic between the client's resolver and the authority, not the client.

[florisbrunet]

I noticed this too. I am using Google DNS over HTTPS inside Google Chrome and am getting different results for IPv4-only and IPv4+IPv6 dual-stack. The results should be exactly the same as the resolver did not change, however, they are different for IPv4 and IPv6

IPv4

IPv6

[jelu]

The results should be exactly the same as the resolver did not change

That is kinda incorrect. Google has large resolver clusters doing the querying that can come from many different IPs and possibly many different networks also.

Screenshots doesn't help if you want me to look closer on the result.

I need the ID of the check.

[florisbrunet]

Here are the IDs:

IPv4-only

v5agk8tc1h2mp5c0fbqaql97bs    RPKI IPv4    Failure
rcvfaaca150lj5ksnpkqm13ve0    RPKI IPv6    Success
8lgh7leq9t5sh8d2un4ktt7hto    IPv6         Failure

IPv4 + IPv6

f6lpe0qja51jn9uchh9hfrkkls    RPKI IPv4    Failure
6bu0637hf569lf5p91kvd26jcc    RPKI IPv6    Failure
0lmb4664j53290j44qa5plcin8    IPv6         Success

[jelu]

Perfect, thanks! Will look at this late next week.

[jelu]

@debrunet You're reported issue has been fixed now, but it was not really related to the original issue because client IPv6 capabilities does not affect RPKI checks.

In a sense, what's misleading is marking IPv6 check failed if client is missing capabilities as it should only show what the resolver is capable at.