Review of the .nz DNSSEC Chain Validation Incident on 29-30 May 2023 [pdf]

Re:Review of the .nz DNSSEC Chain Validation Incident on 29-... by comex on Monday October 09, 2023 @04:03AM (#37818112)

Also, the software they were using (OpenDNSSEC) had an automated delay to avoid exactly this issue, but the delay period was based on a setting in its config file that was supposed to reflect the TTL of the DS record, and they forgot to change it when the TTL changed.

[ Parent | on HN ]

Re:Review of the .nz DNSSEC Chain Validation Incident on 29-... by jeroenhd on Monday October 09, 2023 @06:16AM (#37818822)

I think that is the core issue. I do wonder why this TTL is determined by a config file and not a direct TTL query to the root servers. A mismatch between the two should at least provide a warning, I would think?

[ Parent | on HN ]

Re:Review of the .nz DNSSEC Chain Validation Incident on 29-... by mcesch on Monday October 09, 2023 @04:10PM (#37824869)

OpenDNSSEC's first release was before the root was signed so perhaps there's some assumptions in it that need revisiting.

[ Parent | on HN ]