--- Begin Message ---
Hi,
I'm seeing DNSSEC validation failures for .al. Root DS 26319 doesn't match any
DNSKEY and the zone's keyset has changed several times today (16403, 5419,
56338).
$ dig al. DS +short
26319 13 2 A6974512CCBFF7610B03EF7B68150DCAFC7F8DF4640D619E0020D7532A175D03
The authoritatives currently disagree. ns1.nic.al returns NODATA for DNSKEY:
$ dig DNSKEY al. @194.1.149.230
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4677
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; AUTHORITY SECTION:
al. 300 IN SOA ns1.nic.al. domain.akep.al. 1783095816 10600 3600 1209600 7200
nsx.nic.al serves keys:
$ dig DNSKEY al. +multi @194.0.11.108
) ; ZSK; alg = ECDSAP256SHA256 ; key id = 43395
) ; KSK; alg = ECDSAP256SHA256 ; key id = 56338
Validating resolvers SERVFAIL:
$ dig akep.al @1.1.1.1 +dnssec
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 32196
; OPT=15: ("..no SEP matching the DS found for al.")
DNSVIZ: https://dnsviz.net/d/al/akfjNQ/dnssec/
I haven't been able to reach AKEP.
Kyle
--- End Message ---
_______________________________________________
dns-operations mailing list
[email protected]
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
