search

internetstandards / Internet.nl

Internet standards compliance test suite
https://internet.nl
173 stars 36 forks source link

Connection test list only one dns server #1491

Open yanainic opened 3 weeks ago

yanainic commented 3 weeks ago

Hi guys !

Testing the connection I have a weird results on top.nic.br and internet.nl on my tests:

image

I have no doubts that nic.br is a DNSSEC correctly configured.

When I start debug I've been facing a situation here that I've got 2+ DNS configured here on my resolv_list... I changed the code and starts shows 2+ DNS (NIC.br and Akamai)

image

Summing up:

The general result of failed DNSSEC is correct, because AKAMAI failed here.

But NIC.br, in this case, has DNSSEC correctly configured, and the test result shows that it is misconfigured based on the result from AKAMAI.

Wouldn't it be correct to display the entire list of resolvers and show which one is failing?

Links:

https://test.nic.br/connection/43d12a933b594cfb8c42c112265d50ff/results#control-panel-5 https://internet.nl/connection/36d58fe05dd645c992abe54cb655d73a/results#control-panel-5

https://github.com/internetstandards/Internet.nl/blob/fdd80c51650cae362f7351bf999308113aa66c44/interface/templatetags/translate.py#L106C1

The correct would be something like:

=> if not value and len(row_generator) <=1: (line 106)

??

Best Regards Flavio

bwbroersma commented 2 weeks ago

There is only one bogus request, it can be concluded that the fetch (& later visit) of that DNS record can flag the DNSSEC validation as failing. It cannot conclude that other DNS resolvers used for the other records (for IPv6 detection) are DNSSEC validating, since they did not fetch a bogus record.