smbd

list of DNSSEC failed .gov domains

at 2019/01/24 12:00(JST)

recent (affect of US goverment shutdown?)

• ioss.gov http://dnsviz.net/d/ioss.gov/XEkxfg/dnssec/
• adf.gov http://dnsviz.net/d/adf.gov/XEkzDQ/dnssec/
• peacecorpsoig.gov http://dnsviz.net/d/peacecorpsoig.gov/XEkzLg/dnssec/
• dotideahub.gov http://dnsviz.net/d/dotideahub.gov/XEkyXg/dnssec/
• energystar.gov http://dnsviz.net/d/energystar.gov/XEk4QA/dnssec/
• cnss.gov http://dnsviz.net/d/cnss.gov/XEk4Zg/dnssec/

smbd

[smbd@suse smbd]$ dig @a.dns.jp -t ns bunka.go.jp                                                                                                                                   [~]

; <<>> DiG 9.9.9-P1 <<>> @a.dns.jp -t ns bunka.go.jp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60931
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 5
;; WARNING: recursion requested but not available

smbd

[smbd@suse smbd]$ dig @dns-x.sinet.ad.jp -t any bunka.go.jp +multi                                                                                                                  [~]

; <<>> DiG 9.9.9-P1 <<>> @dns-x.sinet.ad.jp -t any bunka.go.jp +multi
; (3 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56950
;; flags: qr aa rd; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 19
;; WARNING: recursion requested but not available

smbd

• DDOS Mitigation: Minimal response to 'any' queries
• DDOS Mitigation: SERVFAIL caching
• DNSSEC: Automatic creation of CDS, CDSKEY records
• DNSSEC: Negative trust anchors
• EDNS Client-Subnet (ECS) option support for authoritative servers
• EDNS EXPIRE option (client side)
• Management: DNSTAP query/response logging
• Management: Squelch duplicate named servers
• Management: Traffic size statistics (per RSSAC02)
• nxdomain-redirect option

smbd

$ dig +noal +ans -t ns twtrdns.net
twtrdns.net.		86400 IN NS ns4.p34.dynect.net.
twtrdns.net.		86400 IN NS ns-370.awsdns-46.com.
twtrdns.net.		86400 IN NS ns-1700.awsdns-20.co.uk.
twtrdns.net.		86400 IN NS ns2.p34.dynect.net.
twtrdns.net.		86400 IN NS ns1.p34.dynect.net.
twtrdns.net.		86400 IN NS ns3.p34.dynect.net.
twtrdns.net.		86400 IN NS ns-1450.awsdns-53.org.
twtrdns.net.		86400 IN NS ns-975.awsdns-57.net.

smbd

$ dig +noal +ans -t ns twitter.com
twitter.com.		1616	IN	NS	d01-02.ns.twtrdns.net.
twitter.com.		1616	IN	NS	d01-01.ns.twtrdns.net.
twitter.com.		1616	IN	NS	ns1.p34.dynect.net.
twitter.com.		1616	IN	NS	r01-01.ns.twtrdns.net.
twitter.com.		1616	IN	NS	ns4.p34.dynect.net.
twitter.com.		1616	IN	NS	ns3.p34.dynect.net.
twitter.com.		1616	IN	NS	ns2.p34.dynect.net.

$ dig +short -t a d01-02.ns.twtrdns.net.

smbd

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

int main(){
  int fd;