dotse/dnscheck — Issue #57: DNSSEC module reports green with no working keys
Author: einar
Created: 2011-12-27 15:56:27+00:00
State: open

Annoying issue this, for example "gislaved.se", where 2 dnskeys exist at child and another one as DS at .SE. (3 different keys). In this case DNSCheck correctly reports "Parent DS does not refer to SEP at child" at level NOTICE (which is good, it could be prepub etc), what it does NOT report is that no valid chain of trust can be found at all. So basically this should be just as bad as DS at parent and no DNSKEY at child, which results in ERROR.

This might not have been possible to achieve without resorting to real dnssec-validation (not just comparing ID's), but considering how the world looks today we kinda need this check to "work". ;p

I also wonder what this message means: "Parent DS(gislaved.se) refers to invalid key at child: DS(gislaved.se/5/1/63802)"?! It's only INFO level, but not sure what it means... ;p ;)

Full test here: "http://dnscheck.iis.se/?time=1324998266&id=1924934&view=basic&lang=&test=standard"