Connection test authoritive NS issues

[bwbroersma]

Connection test DNS issues, see DNSViz and/or Zonemaster for test-ns-signed.internet.nl.

• [x] remove old DS record (id=25189) - update: removed 2024-01-19, see DNSViz
• [ ] mismatched PTR result (cannot solve this, unless NS would change from ns.test-ns-signed.internet.nl to internet.nl. - which could be done?
• [ ] revert the 'Simplify NS setup for test-ns-signed', or actually use the main domain as NS? (internet.nl, since this also fixes the PTR), I prefer the latter, see previous and next point

  $ dig +noall +nottlid +authority @ns1.sidnlabs.nl NS test-ns-signed.internet.nl
  test-ns-signed.internet.nl. IN  NS  proloprod.internet.nl.
  $ dig +noall +nottlid +answer @proloprod.internet.nl NS test-ns-signed.internet.nl
  test-ns-signed.internet.nl. IN  NS  ns.test-ns-signed.internet.nl.

• [ ] currently ns.test-ns-signed.internet.nl has no MX, SPF, etc., actually testing it in the web test gave reason to open these issues:
  • [ ] #1174
  • [ ] #1175
• [ ] upgrade from 1024 RSA to at least 2048 RSA (8), or 512 bits ECDSA P-256 (13)? (needs another DS update) Change algorithm to -a ECDSAP256SHA256 or add -b 2048: https://github.com/internetstandards/Internet.nl/blob/7bb8f53b97ffe467080884250bc0a81f029a978c/docker/unbound/entrypoint.sh#L22-L23
  • [ ] add option to supply private keys via env for easier deployment (less deploy-DNS roundtrips)
• [ ] Disable recursor in config of test-ns-signed
• [ ] Fix SOA MNAME
• [ ] Remove incorrect comment? Since the zone file is not used twice: https://github.com/internetstandards/Internet.nl/blob/7bb8f53b97ffe467080884250bc0a81f029a978c/docker/unbound/test-ns.zone.template#L1 Maybe create test-ns6.zone.template based on test-ns.zone.template with awk? (but it's a bit cryptic, maybe explicitly repeat the ns-label, so a much simpler sed -r '/^ns\t+A\t/d' test-ns.zone.template > test-ns6.zone.template would suffice)

  $ awk '$1=="ns"{ns=1;next}ns==1{print"ns"$0;ns=0;next}{print}' test-ns.zone.template > test-ns6.zone.template

[baknu]

Hi @gthess, do you have any remarks/suggestions regarding the above? Thanks.

[gthess]

For the old DS, algo update and SOA fix I agree. For the rest, and given that this is a test domain, I don't see a reason to care. For the disable recursor issue I have commented in the PR.