dotse/dnscheck — Issue #56: Faulty message in dnscheck regarding DNSSEC
Author: pos42
Created: 2011-12-18 15:09:01+00:00
State: open

BACKGROUND:
I have over the last year done several DNSSEC installations at customer sites. Now with real life experience from these installations I am starting to see a huge problem with the part of dnscheck that do the DNSSEC control.

PROBLEM:
I must say that EVERYONE think that DNSSEC is ok if the simple dnscheck test show a green light for DNSSEC. Looking at the advanced result tab could eventually show that there is no DS at the parent. Ok it's not an error in the zone... But DNSSEC is not fully operational which people believe. And that is the REAL problem.

SUGGESTION:
I assume .SE is sponsoring dnscheck to increase the quality of DNS in Sweden. Therefor I suggest you at least change the green light to a yellow one if the zone is ok but the DS at the parent is missing. This to inform people that DNSSEC is not ok, which is isn't.