search

SSLMate / caatestsuite

Test suite which checks compliance with CAA checking as defined in version 1.4.8 of the CABF Baseline Requirements
https://caatestsuite.com
Apache License 2.0
10 stars 4 forks source link

SERVFAIL and REFUSED errors #6

Open fcristianacc opened 6 years ago

fcristianacc commented 6 years ago

Hi! 🙂 I would like to know how to implement my code in order to return SERVFAIL and REFUSED errors. I am using Lookup(String domain, int Type.CAA) and when it finds CAA records there are no errors (Rcode = 0 (NOERROR)). The RFC 6844 says that this is only valid for not null records. Accordingly, when the records are empty, I can not catch these errors along the lookup, since the records must include something. The expired.caatestsuite-dnssec.com and missing.caatestsuite-dnssec.com domains have the same problem because, as its description indicates, it supposed there is no record. I would appreciate any help and I hope you have understood my point. Thank you so much and best regards! 🙂

AGWA commented 6 years ago

Unfortunately, I'm not sure what you are asking. It might help if you could explain what you are trying to accomplish. Are you trying to set up the CAA test suite and want to know how to induce SERVFAIL and REFUSED errors? Are you trying to implement CAA checking code, as a CA would? Or something else?

fcristianacc commented 6 years ago

I'm sorry. It was a little confused. Exactly! My question is how to induce SERVFAIL and REFUSED errors, because when I'm using the Lookup for the servfail, refused, and even the expired and missing.caatestsuite-dnssec.com domains, it is returned an empty list of CAA records. In addition, it is shown in my console an error message with the NXDOMAIN Rcode. Thank you for your valuable help!