DNSSEC07 (dnssec07)

Status: Final

Purpose

• Determine whether the child zone is signed (based on DNSKEY + covering RRSIG observations) and, for signed zones, whether parent-side DS data is present and consistent.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Child nameserver name/IP items from methodsv2.GetDelNSNamesAndIPs and methodsv2.GetZoneNSNamesAndIPs.
  • Parent nameservers from methodsv2.GetParentNSNamesAndIPs (or undelegated fake-DS data path).
  • SOA, DNSKEY, and DS query responses.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel child and parent query execution fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Build child nameserver set from delegation+zone NS items (grouped by IP).
3. For each unique child nameserver IP (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtypes SOA, DNSKEY, and DS, then skip.
   • Query SOA:
     • If no response, non-NOERROR, non-AA, or no SOA answer, classify nameserver as ignored child NS.
   • Query DNSKEY with DNSSEC enabled:
     • No response -> No Response DNSKEY.
     • Non-AA -> No Auth DNSKEY.
     • RCODE != NOERROR -> Error RCODE DNSKEY.
     • Else inspect answer for an RRSIG covering DNSKEY:
       • If found -> nameserver classified as signed response.
       • Else -> nameserver classified as no DNSKEY-signature response.
4. Build parent nameserver set.
5. Undelegated DS shortcut:
   • If parent-zone fake DS records exist for child, set DS-in-response set to "-" and skip parent DS querying.
6. If no signed child response exists, clear parent evaluation sets and skip DS parent checks.
7. Otherwise, for each unique parent nameserver IP (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype DS, then skip.
   • Query DS with DNSSEC enabled.
   • If response fails required shape (NOERROR, OPT, DO, AA), classify parent nameserver as ignored.
   • Else, if answer contains RRSIG covering DS at child owner name, classify as DS present.
   • Else classify as no DS.
8. Emit child-side signing-state tags:
   • If the union of ignored/no-response/non-auth/unexpected-rcode child sets equals all child nameservers, emit DS07_NOT_SIGNED.
   • Emit detail tags for non-response, non-auth, unexpected-rcode groups.
   • Emit DS07_SIGNED_ON_SERVER for signed-response set.
   • Emit DS07_NOT_SIGNED_ON_SERVER for no-DNSKEY-signature set.
   • Emit DS07_INCONSISTENT_SIGNED if both signed and not-signed-on-server sets are non-empty.
   • Emit DS07_SIGNED if signed set non-empty and no-DNSKEY-signature set empty.
   • Emit DS07_NOT_SIGNED if signed set empty and no-DNSKEY-signature set non-empty.
9. Emit parent DS tags:
   • Emit DS07_NO_DS_ON_PARENT_SERVER for no-DS set, but only when DS-present set is also non-empty (per-server tag fires only for the inconsistent case; when every parent fails to return DS, the aggregate DS07_NO_DS_FOR_SIGNED_ZONE covers it).
   • Emit DS07_DS_ON_PARENT_SERVER for DS-present set.
   • Emit DS07_INCONSISTENT_DS if both no-DS and DS-present sets are non-empty.
   • If zone is considered signed (signed response non-empty and no DNSKEY-signature empty):
     • Emit DS07_NO_DS_FOR_SIGNED_ZONE when no-DS set non-empty and DS-present set empty.
     • Emit DS07_DS_FOR_SIGNED_ZONE when no-DS set empty and DS-present set non-empty.
10. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Upstream reference: dnssec07.md
• Differences (Upstream vs Gonemaster):
  • Upstream: summary text states that if no DNSKEY records are found then no messages are output. Gonemaster: emits not-signed findings (DS07_NOT_SIGNED_ON_SERVER, DS07_NOT_SIGNED) in that case when child responses are otherwise usable.
  • Upstream: parent DS-positive condition is described as requiring DS plus RRSIG covering DS. Gonemaster: parent DS-positive check is driven by presence of an RRSIG covering DS for child owner and does not explicitly assert DS RR presence in the same branch.
  • Upstream: does not explicitly specify testcase boundary and per-query transport debug emissions in this testcase summary. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
• Potential upstream report:
  • no

Edge Cases And Limitations

• Ignored parent nameserver outcomes are tracked internally but have no dedicated DS07 output tag.
• Child transport-disabled path logs rrtypes SOA, DNSKEY, and DS, even though DS is only queried against parent nameservers in this testcase.
• Parent DS evaluation is fully skipped when no signed child response is observed.