Repository navigation
fix(dnssec): omit RRSIG signers that are not a parent of the qname - #80
Merged
Merged
Conversation
telefonica.com has no DS in com, yet its servers answer A with an RRSIG
whose signer is cloudflare.net. That signer cannot have signed the name;
the validator flagged it out-of-bailiwick and the island check then
required cloudflare.net (a signed zone) to be insecure, so every answer
was Bogus -> SERVFAIL -> public fallback, while Google and Cloudflare
return it without AD.
Unbound omits such a signer ("signer name is not a parent of lookupname,
omitted") and validates the answer as unsigned against the qname's own
chain. signersAuthenticatedInsecure now does the same: out-of-bailiwick
signers are skipped, and when none is left the qname's chain must prove
an authenticated no-DS. An unsigned answer inside a signed zone stays
Bogus.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
diggyen
force-pushed
the
fix/dnssec-out-of-bailiwick-signer
branch
from
October 30, 2026 22:42
eef7139 to
e8f5a20
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
telefonica.comhas no DS incom, but its servers (dns1/dns2.movistar.es) answer A with an RRSIG whose signer iscloudflare.net.. The validator marked that RRSIG out-of-bailiwick, and the island-of-security check then requiredcloudflare.net(which is signed) to be insecure. Every answer came out Bogus → SERVFAIL → public fallback: 26 fallback entries on 2026-10-29 alone. Google and Cloudflare both return the answer without AD.Fix
This now matches Unbound (
validator.cprocessInit: "this signer name is not a parent of lookupname, omitted"):signersAuthenticatedInsecurenow skips signers that are not an ancestor of the qname.The same function is used for denial responses, so the behaviour is the same there.
Tests
TestValidateResponse_UnrelatedSignerUnderInsecureDelegation_IsInsecurefails without the fix (Bogus).TestValidateResponse_UnrelatedSignerInSignedZone_StaysBoguschecks that fail-closed is unchanged.-tags live):TestLive_UnrelatedSigner_Telefonica_NotBogusgives Bogus before the fix and Insecure after.go test ./...passes.🤖 Generated with Claude Code