Test fails because it may be improperly testing an SOA that is unreachable.

[msdlogic]

Per test, https://ednscomp.isc.org/ednscomp/7cf253642c

We have an SOA that is not reachable publicly due to how we structure our DNS servers.
The SOA is not listed as an NS server, however this tool tests it anyways and reports it as a failure.

We are otherwise fully in compliance, yet we have one customer so far complaining about this thinking they will go offline tomorrow.

Any thoughts on this? Should the tool be modified to not test the SOA?

Matt

[vcunat]

• SOA at the apex of the zone is mandatory (since forever)
• non-reply isn't an option, perhaps with an exception when you're being attacked; but even there you should usually be better off with an empty answer with SERVFAIL or something
• I can't see any answer even for A from that server

kdig hueber-breuer.com. A @54.69.28.245
;; WARNING: response timeout for 54.69.28.245@53(UDP)

[msdlogic]

The SOA is firewalled and only replies to our public caching DNS servers. The NS records for the domain are these public servers. This is to limit any load on the SOA nameserver.

I agree with you that SOA is required and maybe a SERVFAIL type response is a good idea, but I'm not aware of a requirement that it -must- be available to the public.

[marka63]

If you don't want the server to be queried do not list it in the NS records that you advertise to the public.

The tool make a query for the NS records for the zone. Then the address records for each of the listed servers (A and AAAA). It then tests each of them.

[beetle:~/git/bind9] marka% dig ns hueber-breuer.com
;; BADCOOKIE, retrying.

; <<>> DiG 9.13.1+hotspot+add-prefetch+marka <<>> ns hueber-breuer.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39092
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 8

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: bda5b9fe7408d94574b087225c520680d1249930897856e3 (good)
;; QUESTION SECTION:
;hueber-breuer.com. IN NS

;; ANSWER SECTION:
hueber-breuer.com. 869 IN NS ns0.northland.net.
hueber-breuer.com. 869 IN NS ns3.northland.net.
hueber-breuer.com. 869 IN NS ns1.northland.net.
hueber-breuer.com. 869 IN NS ns2.northland.net.

;; ADDITIONAL SECTION:
ns2.northland.net. 172767 IN A 54.68.52.84
ns0.northland.net. 271 IN A 54.69.28.245
ns1.northland.net. 172767 IN A 216.171.180.242
ns3.northland.net. 172767 IN A 216.171.184.242
ns2.northland.net. 172767 IN AAAA 2606:fe00:8000:2::242
ns1.northland.net. 172767 IN AAAA 2606:fe00:0:2::242
ns3.northland.net. 172767 IN AAAA 2606:fe00:8000:2::242

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jan 31 07:18:08 AEDT 2019
;; MSG SIZE rcvd: 307

[beetle:~/git/bind9] marka%

[msdlogic]

@marka63 You are totally right. We completely missed that it was in fact an NS record. Removed that NS record and the test passes.

Thanks for your explanation. It's been a long day.