tobez/validns — Issue #7: Validation of NSEC chains seem buggy
Author: pawal
Created: 2011-10-31 14:01:22+00:00
State: open

I get a lot of NSEC validation problems while testing the .se zone now, example:

/home/pawal/antispam/se.new:10184434: NSEC says xn--ulrikskldblogg-dib.se. comes after xn--ulriksfrskringsblogg-jzb70b.se., but a.ns.xn--ulriksfrskringsblogg-jzb70b.se. does
/home/pawal/antispam/se.new:10184443: NSEC says xn--ultraljudsskrmma-7nb.se. comes after xn--ulrikskldblogg-dib.se., but a.ns.xn--ulrikskldblogg-dib.se. does

This is the content of the zone file:

xn--ulriksfrskringsblogg-jzb70b.se. 7200 IN NSEC xn--ulrikskldblogg-dib.se. NS NSEC \
RRSIG
xn--ulriksfrskringsblogg-jzb70b.se. 86400 IN NS a.ns.xn--ulriksfrskringsblogg-jzb70b\
.se.
a.ns.xn--ulriksfrskringsblogg-jzb70b.se. 86400 IN A 178.73.224.237
xn--ulrikskldblogg-dib.se. 7200 IN RRSIG NSEC 5 2 7200 20111110080515 (
20111027170504 33951 se.
QzarSfVI7VknY1PxQEO0ySkhpPoKg7BbzilsyoMVofVpH
DA11Vsn2alwuaQkx6vxu2W1C2RyolEJG8fSmO8A4cxd9q
EkWNoDJK8frkiN2PuCY3uI1u+BIiX1rxbVZO+qqk05hFr
o6szHzZNtlmlWSoqaRedkf3h4i4iU0S/rudY= )
xn--ulrikskldblogg-dib.se. 7200 IN NSEC xn--ultraljudsskrmma-7nb.se. NS NSEC RRSIG
xn--ulrikskldblogg-dib.se. 86400 IN NS a.ns.xn--ulrikskldblogg-dib.se.
a.ns.xn--ulrikskldblogg-dib.se. 86400 IN A 178.73.238.252
xn--ultraljudsskrmma-7nb.se. 7200 IN RRSIG NSEC 5 2 7200 20111111210454 (
20111029190504 33951 se.
J7MVJJhqYq/6GC53Pf2vmVLZI2XiRaPKvQY8oi7Y7OyxV
f0avF6SrLaJ4+IMLUCVK+sV3Q2XyRPN7nnlib9BiTglaM
QHsgdAujduQY4n35cl57p3rPwMmJIdScv0OZnWPQU1IIM
GtpkIJqGZMLcC5/+P2WXCOTtXph2y/ArkgkM= )

xn--ulriksfrskringsblogg-jzb70b.se. has been delegated (with the NS) so therefore a.ns.xn--ulriksfrskringsblogg-jzb70b.se is glue that should not be covered by NSEC.

See RFC 4034 section 4, and 4.1.1:

Owner names of RRsets for which the given zone is not authoritative
(such as glue records) MUST NOT be listed in the Next Domain Name
unless at least one authoritative RRset exists at the same owner
name.