nanog mailing list archives

webex.com DNS Contact - Possibly Broken DNSSEC?


From: Reuben Farrelly via NANOG <nanog () nanog org>
Date: Tue, 9 May 2023 23:33:29 +1000

Does anyone know of a contact of someone (presumably at Webex/Cisco) who can take a look at the DNS for webex.com?

It has been for some time now, logging a lot of DNSSEC warnings on my resolver:

dnssec: validating external-media75.public.wnrtm-a-2.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) dnssec: validating external-media75.public.wsinm-a-3.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) dnssec: validating external-media78.public.wbomm-a-2.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s) dnssec: validating external-media8.public.wnrtm-a-2.prod.infra.webex.com/NSEC: no valid signature found: 1 Time(s)

(and a whole lot more hostnames in the same domain). Some basic DNSSec analysis indicates something in the middle of the trust chain is broken:

https://dnssec-analyzer.verisignlabs.com/external-media26.public.wjfkm-a-3.prod.infra.webex.com

It looks to me like the subdomains have DS records but the other parts of the subdomain don't and I guess there's no point in having DS records on host records, if the parent domain doesn't have them too.

I wouldn't bother if it was one or two entries, but it looks like the whole domain is affected and this probably is a fairly widely utilised domain.

Thanks,
Reuben


Current thread: