DNSSEC11 (dnssec11)

Status: Final

Purpose

• Verify that parent-side DS presence is consistent with child-side DNSKEY presence (zone signing expectation), including parent consistency and child consistency reporting.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Parent nameservers from parentNameservers.
  • Child nameservers from methods.Method4 and methods.Method5.
  • DS, SOA, and DNSKEY query responses.
  • Optional undelegated DS records (FakeDSRecords) when fake-address mode is active.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel parent/child nameserver execution fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Build parent nameserver set, deduplicate by IP.
3. Undelegated shortcut:
   • If fake-address mode is active and undelegated DS records are absent, emit TEST_CASE_END and return.
4. Parent DS phase (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype DS and skip.
   • Query DS with DNSSEC enabled over UDP; if TC is set, retry over TCP.
   • If response is absent, non-NOERROR, or non-AA, classify nameserver as Undetermined DS.
   • Else, if apex DS records are absent classify as No DS, otherwise Has DS.
5. Parent decision:
   • Undetermined DS only => emit DS11_UNDETERMINED_DS, stop before child phase.
   • No DS only => emit DS11_NO_PARENT_DS, stop before child phase.
   • Mixed No DS and Has DS => emit DS11_INCONSISTENT_DS, DS11_PARENT_WITHOUT_DS, DS11_PARENT_WITH_DS, then continue to child phase.
   • Has DS only => continue to child phase.
6. Child phase (only when parent decision allows):
   • Build child nameserver set from Method4+Method5, deduplicate by IP.
   • For each nameserver (parallelized):
     • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtypes SOA and DNSKEY and skip.
     • Query SOA over UDP (UseVC=false); require usable authoritative apex SOA.
     • Query DNSKEY over UDP (UseVC=false), retry over TCP on truncation.
     • Classify nameserver as Undetermined signed zone, No DNSKEY, or Has DNSKEY.
7. Child decision:
   • Undetermined only => emit DS11_UNDETERMINED_SIGNED_ZONE.
   • No DNSKEY only => emit DS11_DS_BUT_UNSIGNED_ZONE.
   • Mixed No DNSKEY and Has DNSKEY => emit DS11_INCONSISTENT_SIGNED_ZONE, DS11_NS_WITH_UNSIGNED_ZONE, DS11_NS_WITH_SIGNED_ZONE.
   • Has DNSKEY only (no undetermined, no absent) => emit DS11_CONSISTENT_SIGNED.
8. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Upstream reference: dnssec11.md
• Differences (Upstream vs Gonemaster):
  • Upstream: describes normal parent lookup through Method1 and undelegated behavior from test-type inputs. Gonemaster: uses the parentNameservers abstraction plus a fake-DS shortcut via nameserver FakeDSRecords.
  • Upstream: does not explicitly specify testcase boundary and per-query transport debug emissions in this testcase summary. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
• Potential upstream report:
  • no

Edge Cases And Limitations

• Nameserver evaluation is deduplicated by IP; repeated names on one IP share one DS11 outcome.
• When parent evaluation yields only No DS (and no Has DS), testcase emits DS11_NO_PARENT_DS and exits without child checks.
• Child-side undetermined classification requires SOA preconditions to pass first; unusable SOA responses are skipped before DNSKEY classification.