<div dir="ltr">And if I use Free.fr's servers, the DS resolves (I'm running CeroWRT double-NAT behind a Freebox v6):<div><br></div><div><div>dig @<a href="http://192.168.1.254">192.168.1.254</a> DS <a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a></div>
<div><br></div><div>; <<>> DiG 9.8.5-P1 <<>> @<a href="http://192.168.1.254">192.168.1.254</a> DS <a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a></div>
<div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11369</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0</div>
<div><br></div><div>;; QUESTION SECTION:</div><div>;<a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a>. IN DS</div><div><br></div><div>;; AUTHORITY SECTION:</div>
<div><a href="http://cn.akamaiedge.net">cn.akamaiedge.net</a>.<span class="" style="white-space:pre"> </span>1800<span class="" style="white-space:pre"> </span>IN<span class="" style="white-space:pre"> </span>SOA<span class="" style="white-space:pre"> </span><a href="http://n0cn.akamaiedge.net">n0cn.akamaiedge.net</a>. <a href="http://hostmaster.akamai.com">hostmaster.akamai.com</a>. 1398342840 1000 1000 1000 1800</div>
<div><br></div><div>;; Query time: 39 msec</div><div>;; SERVER: 192.168.1.254#53(192.168.1.254)</div><div>;; WHEN: Thu Apr 24 14:34:00 CEST 2014</div><div>;; MSG SIZE rcvd: 127</div></div><div><br></div><div>-Aaron</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 24, 2014 at 2:33 PM, Aaron Wood <span dir="ltr"><<a href="mailto:woody77@gmail.com" target="_blank">woody77@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Well, I'm seeing the same results as you are from here in Paris (using Free.fr).<span class="HOEnZb"><font color="#888888"><div>
<br></div><div>-Aaron</div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 24, 2014 at 1:27 PM, Simon Kelley <span dir="ltr"><<a href="mailto:simon@thekelleys.org.uk" target="_blank">simon@thekelleys.org.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 24/04/14 11:49, Aaron Wood wrote:<br>
<br>
><br>
>> Dnsmasq does the DS query next because the answer to the A query comes<br>
>> back unsigned, so dnsmasq is looking for a DS record that proves this is<br>
>> OK. It's likely that Verisign does that top-down (starting from the<br>
>> root) whilst dnsmasq does it bottom up. Hence Verisign never finds the<br>
>> broken DS, whilst dnsmasq does.<br>
>><br>
>> That's as good an analysis as I can produce right now. Anyone who can<br>
>> shed more light, please do.<br>
>><br>
>> (And yes, please report DNSSEC problems on the dnsmasq-discuss list for<br>
>> preference.)<br>
>><br>
><br>
> This is still persisting (and it appears to be blocking a bunch of Apple<br>
> software update functions). From your comments, Simon, it sounds like you<br>
> think this is an Akamai issue, and should be reported to them?<br>
><br>
<br>
</div>I'm not absolutely sure that this isn't also a dnsmasq problem, and<br>
DNSSEC is still capable of surprising me, but I can't see how a SERVFAIL<br>
answer to<br>
<br>
dig @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> DS <a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net" target="_blank">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a><br>
<br>
can not be either a Google ('cause it's their recursive server) or<br>
Akamai problem.<br>
<br>
Poking further, it looks like the authoritative name servers for that<br>
zone are<br>
<br>
; <<>> DiG 9.8.1-P1 <<>> @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> NS <a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a><br>
<div>; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
</div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43031<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 0<br>
<br>
;; QUESTION SECTION:<br>
;<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. IN NS<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n7cn.akamaiedge.net" target="_blank">n7cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n6cn.akamaiedge.net" target="_blank">n6cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n0cn.akamaiedge.net" target="_blank">n0cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n2cn.akamaiedge.net" target="_blank">n2cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n5cn.akamaiedge.net" target="_blank">n5cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n4cn.akamaiedge.net" target="_blank">n4cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n3cn.akamaiedge.net" target="_blank">n3cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n1cn.akamaiedge.net" target="_blank">n1cn.akamaiedge.net</a>.<br>
<a href="http://cn.akamaiedge.net" target="_blank">cn.akamaiedge.net</a>. 299 IN NS <a href="http://n8cn.akamaiedge.net" target="_blank">n8cn.akamaiedge.net</a>.<br>
<br>
and all of those give sensible answers for<br>
<br>
DS <a href="http://e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net" target="_blank">e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net</a><br>
<br>
except <a href="http://n8cn.akamaiedge.net" target="_blank">n8cn.akamaiedge.net</a>, which isn't responding, so I rather think<br>
this may be a Google mess.<br>
<br>
Or maybe it's Great Firewall induced breakage?<br>
<br>
Cheers,<br>
<br>
<br>
Simon.<br>
<br>
<br>
<br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>