I have found another instance where Cloudflare incorrectly resolves a BOGUS
domain, à la “1.1.1.1 BUG: fails validating basic DNSSEC [FIXED]”.
This is from the “Test your connection” on https://internet.nl/. The DNSSEC test fails for Cloudflare. After investigating I noticed that the domain used in the test xxxxxxxxxx.bogus.conn.test-ns-signed.internet.nl
always resolves using Cloudflare, even though it’s BOGUS
. DNSViz and DiG output can be found below for several other resolvers, which return a SERVFAIL
. @mvavrusa could you check this one out as well?
Cloudflare
[email protected] ~ % dig @1.1.1.1 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl
; <<>> DiG 9.10.6 <<>> 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28697
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl. IN A
;; ANSWER SECTION:
27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl. 3600 IN A 62.204.66.10
;; Query time: 28 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Thu Oct 07 11:57:35 CEST 2021
;; MSG SIZE rcvd: 115
[email protected] ~ % dig @8.8.8.8 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl
; <<>> DiG 9.10.6 <<>> 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 34354
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl. IN A
;; Query time: 34 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 07 11:59:17 CEST 2021
;; MSG SIZE rcvd: 99
Quad9
[email protected] ~ % dig @9.9.9.9 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl
; <<>> DiG 9.10.6 <<>> 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 468
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; OPT=15: 00 0a ("..")
;; QUESTION SECTION:
;27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl. IN A
;; Query time: 33 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Thu Oct 07 11:59:26 CEST 2021
;; MSG SIZE rcvd: 105
OpenDNS
[email protected] ~ % dig @208.67.222.222 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl
; <<>> DiG 9.10.6 <<>> 27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl @208.67.222.222
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 17679
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;27a338a67ae442e3bfb1980ef98a2285.bogus.conn.test-ns-signed.internet.nl. IN A
;; Query time: 47 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Thu Oct 07 11:59:34 CEST 2021
;; MSG SIZE rcvd: 99