Re: medicare.gov / cms.gov DNSSEC Validation Failures

[Mark Andrews <marka () isc org>]

In message <1293658659.2817.17.camel () watermelon coderich net>, Richard Laager w
> On Wed, 2010-12-29 at 12:32 -0500, Christopher J. Pilkington wrote:
> > On Tue, Dec 28, 2010 at 06:39:21PM -0600, Richard Laager wrote:
> > > I'm looking for a DNS contact for medicare.gov (and cms.gov). They are
> > > failing DNSSEC validation.
> > =20
> > Seeing it still broken, I contacted someone over at Lockheed who
> > works over at CMS.  They're escalating to "the appropriate
> > support vendor."
>
> Thank you both for forwarding this. Some progress has been made:
>
> I received a response saying they believed they had it fixed. From my
> testing, medicare.gov is fixed, but cms.gov is still broken (though in a
> different way, I think). I replied as such and also requested corrected
> SOA records.
>
> Thanks again,
> Richard
 
Correct cms.gov is still broken the DS records don't match any of the
DNSKEY records.  10672 != 12456 or 27229

Mark

; <<>> DiG 9.6.0-APPLE-P2 <<>> ds cms.gov
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21811
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cms.gov.                       IN      DS

;; ANSWER SECTION:
cms.gov.                30410   IN      DS      10672 5 1 F11F940C51B90CEB818350F1C7049DD8D54050D8
cms.gov.                30410   IN      DS      10672 5 2 A99B67A100FD5EFD0E393FD0C87A6B00424B6A4A032637BC7A11D732 
E05AD5BB

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Dec 31 00:12:23 2010
;; MSG SIZE  rcvd: 109


; <<>> DiG 9.6.0-APPLE-P2 <<>> +cd dnskey +multi cms.gov
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62756
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cms.gov.               IN DNSKEY

;; ANSWER SECTION:
cms.gov.                349199 IN DNSKEY 256 3 5 (
                                AwEAAaSsgUpPtXC4xOHnX//jDm4d4xegc9zupcXwICfm
                                4jeBD+ZNHJeTSrxPnILqDb310Jxy6UDi6ye0ipOWG8z6
                                b1oOwmF8LRnpWs+bi9X+AivagVXP2xQQe/pev8KrmMFs
                                UcLZ1PX4w+GxNgsoUGre235fv9IM/EfdD33zSNxeA463
                                ) ; key id = 12456
cms.gov.                349199 IN DNSKEY 257 3 5 (
                                AwEAAbZbZW7J+O5/tSwDVrGsv5KDDB7HvItDVeQLvdpr
                                GdyJPVlUvs+u87hsCDU96SwmicXTDGdWZFDmj3x22O4p
                                dERsrKoKYpOAoNR3VLgXMToRZmUnaLZf/MqO+H/54PE7
                                Ij7oorWmPJpIZrYzn28MMIiOkH1xOS7eDL2NZ4q06oDN
                                vSDefX3HA5i2sUcOureEFUo6gUkLFkY/uPJ3y35A8uz1
                                KvGd4851UAEfq76sawDl+3uKzETDS5grwmK58NbKKB2O
                                5SAcAS3OxBMriKLUHjsPpwoxKoG5Mc+jA0egIn7tUAQU
                                zzI0HHnspZvZUEbW18uMTFAQX2du2eyGcMwvGEs=
                                ) ; key id = 27229

;; Query time: 304 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Dec 31 00:12:47 2010
;; MSG SIZE  rcvd: 449

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka () isc org