DNSSEC03 (dnssec03)

Status: Final

Purpose

• Verify NSEC3 parameter consistency and policy compliance across child nameservers when DNSKEY support is present.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Child nameserver list from methods.Method4and5.
  • DNSKEY and NSEC query responses from child nameservers.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel nameserver query execution fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Resolve nameservers from Method4+Method5 and deduplicate by IP.
3. For each unique nameserver IP (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtypes DNSKEY and NSEC and skip.
   • Query DNSKEY:
     • If response is absent, non-NOERROR, or non-AA, skip nameserver without DS03 findings.
     • If no apex DNSKEY is present, mark nameserver in Responds Without DNSKEY.
     • Else mark nameserver in Responds With DNSKEY and continue.
   • Query NSEC:
     • No response -> mark No Response NSEC Query.
     • Non-NOERROR or non-AA -> mark Error Response NSEC Query.
     • No NSEC3 in authority -> mark Responds Without NSEC3.
     • Otherwise mark Responds With NSEC3; if multiple NSEC3 RRs exist, also mark Multiple NSEC3.
     • Use the first NSEC3 RR to extract hash algorithm, flags, iterations, and salt-length value.
4. Emit DNSSEC-support summary tags:
   • DS03_NO_DNSSEC_SUPPORT if no nameserver had DNSKEY but at least one lacked DNSKEY.
   • DS03_SERVER_NO_DNSSEC_SUPPORT if mixed DNSKEY support exists.
5. Emit NSEC3-availability summary tags:
   • DS03_NO_NSEC3 if no nameserver had NSEC3 but at least one lacked NSEC3.
   • DS03_SERVER_NO_NSEC3 if mixed NSEC3 support exists.
6. Emit DS03_ERR_MULT_NSEC3 for nameservers that returned more than one NSEC3 RR.
7. Hash algorithm checks:
   • Emit DS03_INCONSISTENT_HASH_ALGO when more than one hash value appears.
   • Emit DS03_LEGAL_HASH_ALGO for value 1; otherwise emit DS03_ILLEGAL_HASH_ALGO with algo_num.
8. NSEC3 flags checks:
   • Emit DS03_INCONSISTENT_NSEC3_FLAGS when more than one flags value appears.
   • For each flags value, emit DS03_UNASSIGNED_FLAG_USED for set bits 0..6.
   • Determine opt-out from bit 7:
     • Emit DS03_NSEC3_OPT_OUT_ENABLED_TLD when bit 7 is set and tested zone is root or single-label TLD.
     • Emit DS03_NSEC3_OPT_OUT_ENABLED_NON_TLD when bit 7 is set and zone is not root/single-label TLD.
     • Emit DS03_NSEC3_OPT_OUT_DISABLED when bit 7 is unset.
9. Iteration checks:
   • Emit DS03_INCONSISTENT_ITERATION when multiple values appear.
   • Emit DS03_LEGAL_ITERATION_VALUE for value 0; otherwise DS03_ILLEGAL_ITERATION_VALUE with int.
10. Salt-length checks:
    • Emit DS03_INCONSISTENT_SALT_LENGTH when multiple lengths appear.
    • Emit DS03_LEGAL_EMPTY_SALT for length 0; otherwise DS03_ILLEGAL_SALT_LENGTH with int.
11. Emit per-nameserver NSEC query-error tags:
    • DS03_NO_RESPONSE_NSEC_QUERY for each nameserver that returned no NSEC query response.
    • DS03_ERROR_RESPONSE_NSEC_QUERY for each nameserver that returned a non-NOERROR or non-AA NSEC response.
12. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Upstream reference: dnssec03.md
• Differences (Upstream vs Gonemaster):
  • Upstream: allows TLD-like classification based on Public Suffix List data for opt-out interpretation. Gonemaster: treats TLD context as only root (.) or a direct single-label TLD (no PSL-based classification in this testcase).
  • Upstream: does not explicitly specify testcase boundary and per-query transport debug emissions in this testcase summary. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
• Potential upstream report:
  • no

Edge Cases And Limitations

• When multiple NSEC3 records are present, only the first NSEC3 RR is used for parameter extraction (hash, flags, iterations, salt length).
• Nameservers whose DNSKEY response fails shape checks (NOERROR and AA) are silently skipped for DS03 finding sets.
• Salt length is derived from the NSEC3 Salt string length used by the implementation, not a decoded-octet length conversion step.