DNSSEC01 (dnssec01)

Status: Final

Purpose

• Validate DS digest algorithm usage for the child delegation and classify each observed DS digest type.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Parent nameserver names/IPs from methodsv2.GetParentNSNamesAndIPs.
  • Optional undelegated DS records exposed via parent nameserver FakeDSRecords.
  • DS query responses for child zone name from parent nameservers.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel parent-query execution fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Initialize classification sets for DS digest classes, plus tracking sets for:
   • parent nameservers ignored due to invalid response shape,
   • parent nameservers responding without valid DS owner,
   • parent nameservers responding with DS,
   • keytags seen with digest algorithm 2 vs non-2.
3. Resolve parent nameserver names/IPs.
4. Check undelegated DS input path:
   • If parent fake DS records are present, classify those DS records immediately with source servers value -.
   • Mark parent-NS query list empty so external parent DS queries are skipped.
5. For each unique parent nameserver IP (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype DS and skip.
   • Send DS query with DNSSEC enabled.
   • If response is absent or fails required shape checks (NOERROR, OPT, DO, AA), mark nameserver as ignored.
   • If response has no DS record with owner matching child zone name, mark nameserver in Responds Without Valid DS.
   • Else mark nameserver in Responds With DS and classify each DS digest algorithm into the corresponding DS01 tag set.
6. Emit DS classification tags (DS01_DS_ALGO_*) grouped by (digest, keytag) with merged servers.
7. Emit DS01_DS_ALGO_2_MISSING for keytags that have non-2 DS but no digest-2 DS on the same source nameservers.
8. If no valid/non-valid DS responders exist and ignored responders exist, emit DS01_NO_RESPONSE.
9. Emit informational tags based on zone type and undelegated DS status:
   • If zone is root (.), emit DS01_ROOT_N_NO_UNDEL_DS when no undelegated DS records were provided.
   • If zone is undelegated and non-root, emit DS01_UNDEL_N_NO_UNDEL_DS when no undelegated DS records were provided.
10. If Responds Without Valid DS is non-empty:
    • Emit DS01_PARENT_ZONE_NO_DS when no nameserver responded with DS.
    • Otherwise emit DS01_PARENT_SERVER_NO_DS.
11. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Upstream reference: dnssec01.md
• Differences (Upstream vs Gonemaster):
  • Upstream: does not explicitly specify testcase boundary and per-query transport debug emissions in this testcase summary. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
  • Upstream: Summary argument list omits ds_algo_descr for some DS01 tags. Gonemaster: includes ds_algo_descr for all emitted DS01_DS_ALGO_* classification tags.
• Potential upstream report:
  • no

Edge Cases And Limitations

• If no parent nameservers are available and no undelegated DS data exists, only the applicable root/undelegated informational tags and testcase boundary tags are emitted.
• For undelegated DS input, servers uses the sentinel source value -.
• DS answer processing requires at least one DS with owner matching child zone, but once accepted the testcase classifies all DS records in that answer section.