<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0cm;
margin-bottom:.0001pt;
font-size:8.5pt;
font-family:Menlo;
color:black;}
p.p2, li.p2, div.p2
{mso-style-name:p2;
margin:0cm;
margin-bottom:.0001pt;
font-size:8.5pt;
font-family:Menlo;
color:black;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.s1
{mso-style-name:s1;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In response to my own message, it looks like there is actually no problem at all. My apologies for the noise.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My mistake was in the fact that the <span class="s1">17.2.in-addr.arpa</span> NSEC record has a ‘next’ field of
<span class="s1">71.179.2.in-addr.arpa</span>, which in fact proves the existence of 179.2.in-addr.arpa which in turn blocks the synthesis of *.2.in-addr.arpa. This changes the required proof to denying *.179.2.in-addr.arpa and 210.179.2.in-addr.arpa, both
of which are denied by that same 17.2.in-addr.arpa NSEC record.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Again, sorry for the noise.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--<o:p></o:p></p>
<p class="MsoNormal">Brian<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">"Brian Somers (brsomers)" <brsomers@cisco.com><br>
<b>Date: </b>Friday, October 4, 2019 at 3:56 PM<br>
<b>To: </b>"dnssec-ops@afrinic.net" <dnssec-ops@afrinic.net><br>
<b>Subject: </b>DNSSEC missing NSEC records<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Hopefully this email will reach a human. In summary, I am querying your nameservers with a query who’s response is a negative result. The negative result does not supply correct NSEC proof, so the result is being thrown away. According
to your web page at <a href="https://afrinic.net/dnssec">https://afrinic.net/dnssec</a>, you are using standard tools, so perhaps an upgrade is necessary?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The details:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="p1"><span class="s1">$ dig +dnssec PTR 55.210.179.2.in-addr.arpa</span><o:p></o:p></p>
<p class="p2"> <o:p></o:p></p>
<p class="p1"><span class="s1">; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec PTR 55.210.179.2.in-addr.arpa</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; global options: +cmd</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; Got answer:</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13221</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1</span><o:p></o:p></p>
<p class="p2"> <o:p></o:p></p>
<p class="p1"><span class="s1">;; OPT PSEUDOSECTION:</span><o:p></o:p></p>
<p class="p1"><span class="s1">; EDNS: version: 0, flags: do; udp: 16384</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; QUESTION SECTION:</span><o:p></o:p></p>
<p class="p1"><span class="s1">;55.210.179.2.in-addr.arpa. </span><span class="apple-converted-space">
</span><span class="s1">IN</span><span class="apple-converted-space"> </span>
<span class="s1">PTR</span><o:p></o:p></p>
<p class="p2"> <o:p></o:p></p>
<p class="p1"><span class="s1">;; AUTHORITY SECTION:</span><o:p></o:p></p>
<p class="p1"><span class="s1">2.in-addr.arpa. </span><span class="apple-converted-space">
</span><span class="s1">529 </span><span class="apple-converted-space"> </span>
<span class="s1">IN</span><span class="apple-converted-space"> </span><span class="s1">SOA
</span><span class="apple-converted-space"> </span><span class="s1">pri.authdns.ripe.net. dns.ripe.net. 1570034799 3600 600 864000 3600</span><o:p></o:p></p>
<p class="p1"><span class="s1">2.in-addr.arpa. </span><span class="apple-converted-space">
</span><span class="s1">529 </span><span class="apple-converted-space"> </span>
<span class="s1">IN</span><span class="apple-converted-space"> </span><span class="s1">RRSIG
</span><span class="apple-converted-space"> </span><span class="s1">SOA 8 3 3600 20191018205054 20191004192054 48919 2.in-addr.arpa. XQQvfbQaC362wJKmA/77JlP4kL3EFsmAs3+ByNfUreFxDYAa/no6PqFO OkyL9n0TYnaxT66vNCktUscMQvO1M5gNJ19tPDlZA+pVN2nzGZZzfUql WJl9EwfyLFkO2ZmwIBBdejgPtUuiS6qdg8r/4oESfEch+YgcNNJrDzTb
ts4=</span><o:p></o:p></p>
<p class="p1"><span class="s1">17.2.in-addr.arpa.</span><span class="apple-converted-space">
</span><span class="s1">529 </span><span class="apple-converted-space"> </span>
<span class="s1">IN</span><span class="apple-converted-space"> </span><span class="s1">NSEC</span><span class="apple-converted-space">
</span><span class="s1">71.179.2.in-addr.arpa. NS RRSIG NSEC</span><o:p></o:p></p>
<p class="p1"><span class="s1">17.2.in-addr.arpa.</span><span class="apple-converted-space">
</span><span class="s1">529 </span><span class="apple-converted-space"> </span>
<span class="s1">IN</span><span class="apple-converted-space"> </span><span class="s1">RRSIG
</span><span class="apple-converted-space"> </span><span class="s1">NSEC 8 4 3600 20191014161051 20190930144051 48919 2.in-addr.arpa. NIK1UeZMTlTYD/TqjYHH73UUiIkwK0i5YqLWjEh+hXLgmpv9nutrXPE2 YHLSSd6Uev7RwXyfIJ7XoTymuKfeOKvUBiMz3mElf0WOoAmWgcYiCn9y AzPOca/0xJ1lV6k7IUsMdaijsOR6/FRh0adVhb4VmtSh7qJfQEM8cXOk
EiU=</span><o:p></o:p></p>
<p class="p2"> <o:p></o:p></p>
<p class="p1"><span class="s1">;; Query time: 71 msec</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; SERVER: 208.67.222.222#53(208.67.222.222)</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; WHEN: Fri Oct 04 22:37:54 UTC 2019</span><o:p></o:p></p>
<p class="p1"><span class="s1">;; MSG SIZE</span><span class="apple-converted-space">
</span><span class="s1">rcvd: 508</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The response correctly denies the existence of 179.2.in-addr.arpa and everything below it, but it does not deny the existence of *.2.in-addr.arpa (the wildcard record) which, if present, would expand to 55.210.179.2.in-addr.arpa.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">This can be seen also here: <a href="https://dnssec-analyzer.verisignlabs.com/55.210.179.2.in-addr.arpa">
<span style="color:blue">https://dnssec-analyzer.verisignlabs.com/55.210.179.2.in-addr.arpa</span></a><o:p></o:p></p>
<p class="MsoNormal">and here: <a href="http://dnsviz.net/d/55.210.179.2.in-addr.arpa/dnssec/">
http://dnsviz.net/d/55.210.179.2.in-addr.arpa/dnssec/</a><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Are there any plans to address this issue? Thanks for your time.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">--<o:p></o:p></p>
<p class="MsoNormal">Brian<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>