Is it me or does energystar.gov no longer validate?

Unbound
1

Hi,

somebody complained that our resolvers could no longer resolve energystar.gov

https://dnssec-analyzer.verisignlabs.com/energystar.gov

It seems the reports of the crumbling security of the .gov domain as a side-effect of the shutdown aren't exaggerated:

https://news.netcraft.com/archives/2019/01/10/gov-security-falters-during-u-s-shutdown.html

Or am I doing something wrong?

Strange enough, our AD resolvers that forward to our unbound validating resolvers still report an IP, with a TTL of 0 (zero, nought).

Rainer

2

Hi Rainer,

Hi,

somebody complained that our resolvers could no longer resolve
energystar.gov

https://dnssec-analyzer.verisignlabs.com/energystar.gov

It seems the reports of the crumbling security of the .gov domain as a
side-effect of the shutdown aren't exaggerated:

https://news.netcraft.com/archives/2019/01/10/gov-security-falters-during-u-s-shutdown.html

Or am I doing something wrong?

You are not wrong here, the zone contains expired signatures and does
therefore not validate.

-- Ralph

3

somebody complained that our resolvers could no longer resolve
energystar.gov

https://dnssec-analyzer.verisignlabs.com/energystar.gov

It seems the reports of the crumbling security of the .gov domain as a
side-effect of the shutdown aren't exaggerated:

https://news.netcraft.com/archives/2019/01/10/gov-security-falters-during-u-s-shutdown.html

Or am I doing something wrong?

It's not just you; their DNSSEC signatures have expired:

bash-4.4$ dig energystar.gov. ns +norec
...
;; AUTHORITY SECTION:
energystar.gov. 86158 IN NS ns1.energystar.gov.
energystar.gov. 86158 IN NS ns2.energystar.gov.

;; ADDITIONAL SECTION:
ns1.energystar.gov. 86158 IN A 162.159.24.254
ns2.energystar.gov. 86158 IN A 162.159.25.236
ns1.energystar.gov. 86158 IN AAAA 2400:cb00:2049:1::a29f:18fe
ns2.energystar.gov. 86158 IN AAAA 2400:cb00:2049:1::a29f:19ec
...
bash-4.4$ dig @162.159.24.254 energystar.gov. ns +norec +dnssec
...
;; ANSWER SECTION:
energystar.gov. 14400 IN NS ns1.energystar.gov.
energystar.gov. 14400 IN NS ns2.energystar.gov.
energystar.gov. 14400 IN RRSIG NS 8 2 14400 20190113050003 20181204050003 9423 energystar.gov. kB3zF7HOZBskMLHZ4jDO0rLwIklEnkJQfxTJBKKRyw6QPWtK/QdzCgRr QIfkPl7osIoETk0HmAasJMfnOXQ2OIfT/NILhiltI2mYpjVdbjgpmvsR 2SOqzdpxMITDHl2dX7zrB6gN8Sa6jpaWz7z/y4VhP9shC+5rm3xEDsoe dOYq/0484Lu+gerxFEp9nF+0xROxpUGPJiJyPxzvimcDZ3Swyk/jZtVt ltkDKAfvCSpq9XgxMFwNtpegRrk6duz0z4ccePhv67xY/ZKXu0bF7CLs zKp2XFVjCk0iK9CePte+Z43qvDllmZAy6xZgqsni8bmqgDeATOxozNEX f4uQkw==
...

Clearly, we're past 2019.01.13 by now.

I'm however surprised their DNSSEC signature renewal doesn't
appear to have been fully automated.

Regards,

- Håvard

4

OK, thanks everybody.

It's strange how things work over there.

Hopefully, there's somebody being paid to press the button so the ICBMs don't auto-launch because the think everybody's dead :wink:

5

I wouldn't draw too many conclusions about back-end architecture when systems like this might well be being looked after by a stressed, skeleton crew as a result of the US federal government shutdown. Even automated systems fail from time to time. High-availability systems fail more than most, seems to me :slight_smile:

All the best to federal DNS ops people who are in a bad situation right now, for what that's worth. People have been sending pizza to US air traffic control facilities over the past month as high-calorie expressions of support. Maybe we need to find a way to order pizza for DNSSEC systems staff, too. I'd send them some RRSIGs, but that's not how that works.

https://www.cbc.ca/news/canada/north/yellowknife-air-control-pizza-1.4981306

Joe

6

I'm however surprised their DNSSEC signature renewal doesn't
appear to have been fully automated.

I wouldn't draw too many conclusions about back-end
architecture when systems like this might well be being looked
after by a stressed, skeleton crew as a result of the US
federal government shutdown.

Yes, you are right, this is a guess on my part. Also, my quote
above might come off as insensitive to the stress these people
are going through now, and I apologize for that.

Regards,

- Håvard