ibauersachs
commented
5 years ago I can't access your resolver, so I have no idea what's going on there. A simple test based on the example in the readme and Google's public DNS or our internal AD resolver shows no errors:
package org.jitsi.dnssec;
import java.io.*;
import org.jitsi.dnssec.validator.ValidatingResolver;
import org.xbill.DNS.*;
public class Example {
static String ROOT = ". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
public static void main(String[] args) throws Exception {
// Send two sample queries using a standard DNSJAVA resolver
SimpleResolver sr = new SimpleResolver("8.8.4.4");
System.out.println("Standard resolver:");
sendAndPrint(sr, "www.dnssec-failed.org.", Type.A);
sendAndPrint(sr, "www.isc.org.", Type.A);
sendAndPrint(sr, "bger.ch.", Type.MX);
// Send the same queries using the validating resolver with the
// trust anchor of the root zone
// http://data.iana.org/root-anchors/root-anchors.xml
ValidatingResolver vr = new ValidatingResolver(sr);
vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes("ASCII")));
System.out.println("\n\nValidating resolver:");
sendAndPrint(vr, "www.dnssec-failed.org.", Type.A);
sendAndPrint(vr, "www.isc.org.", Type.A);
sendAndPrint(sr, "bger.ch.", Type.MX);
}
private static void sendAndPrint(Resolver vr, String name, int type) throws IOException {
System.out.println("\n---" + name);
Record qr = Record.newRecord(Name.fromConstantString(name), type, DClass.IN);
Message response = vr.send(Message.newQuery(qr));
System.out.println("AD-Flag: " + response.getHeader().getFlag(Flags.AD));
System.out.println("RCode: " + Rcode.string(response.getRcode()));
for (RRset set : response.getSectionRRsets(Section.ADDITIONAL)) {
if (set.getName().equals(Name.root) && set.getType() == Type.TXT
&& set.getDClass() == ValidatingResolver.VALIDATION_REASON_QCLASS) {
System.out.println("Reason: " + ((TXTRecord) set.first()).getStrings().get(0));
}
}
}
}Result:
Standard resolver:
---www.dnssec-failed.org.
AD-Flag: false
RCode: SERVFAIL
---www.isc.org.
AD-Flag: false
RCode: NOERROR
---bger.ch.
AD-Flag: false
RCode: NOERROR
Validating resolver:
---www.dnssec-failed.org.
AD-Flag: false
RCode: SERVFAIL
Reason: validate.bogus.badkey:dnssec-failed.org.:dnskey.no_ds_match
---www.isc.org.
AD-Flag: true
RCode: NOERROR
---bger.ch.
AD-Flag: false
RCode: NOERROR
ralfhauser
Habbie
gryphius
primetomas
mwullink
since this morning, we get . 0 CLASS65280 TXT "Could not establish validation of INSECURE status of unsigned response. Reason: Did not match a DS to a DNSKEY."
e.g. for MX of bger.ch
any hints what wrong ?
212.25.1.1 is the resolver.
<<query: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15318 ;; flags: rd ; qd: 1 an: 0 au: 0 ad: 0 ;; QUESTIONS: ;; bger.ch., type = MX, class = IN
;; ANSWERS:
;; AUTHORITY RECORDS:
;; ADDITIONAL RECORDS:
;; Message size: 0 bytes DEBUG [Thread-106] - got response: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 15318 ;; flags: qr ; qd: 1 an: 0 au: 0 ad: 1 ;; QUESTIONS: ;; bger.ch., type = MX, class = IN
;; ANSWERS:
;; AUTHORITY RECORDS:
;; ADDITIONAL RECORDS: . 0 CLASS65280 TXT "Could not establish validation of INSECURE status of unsigned response. Reason: Did not match a DS to a DNSKEY."