Fragen zum Ergebnis eines DNSreports

Caspar · 3. März 2018

Moin,

da ich im Thema DNSKEY, bzw. allgemein DNS, noch nicht genug Wissen aufweisen kann, wollte ich darum bitten das mir jemand die folgenden beiden Meldungen einmal erläutert.

Dazu vielen Dank im voraus!

Zitat

Parent zone does not provide glue for nameservers, which will cause delays in resolving your domain name. The following nameserver addresses were not provided by the parent 'glue' and had to be looked up individually. This is perfectly acceptable behavior per the RFCs. This will usually occur if your DNS servers are not in the same TLD as your domain (for example, a DNS server of "ns1.example.org" for the domain "example.com"). In this case, you can speed up the connections slightly by having NS records that are in the same TLD as your domain.

root-dns.netcup.net. | No Glue | TTL=86400

third-dns.netcup.net. | No Glue | TTL=86400

second-dns.netcup.net. | No Glue | TTL=86400

Zitat

DNSKEY appears to be missing. There appears to be a record that is missing a corresponding public key, since other records have been signed you must make sure that this record was signed correctly and that it's public key is available for verification. The record missing the DNSKEY is:

third-dns.netcup.net. appears to have a signed SOA record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed NS record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed A record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed MX record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed TXT record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed AAAA record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed DNSKEY record with a key keyTag=21282

third-dns.netcup.net. appears to have a signed DNSKEY record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed NSEC3PARAM record with a key keyTag=51335

third-dns.netcup.net. appears to have a signed A record with a key I can no longer find keyTag=13946

second-dns.netcup.net. appears to have a signed SOA record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed NS record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed A record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed MX record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed TXT record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed AAAA record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed DNSKEY record with a key keyTag=21282

second-dns.netcup.net. appears to have a signed DNSKEY record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed NSEC3PARAM record with a key keyTag=51335

second-dns.netcup.net. appears to have a signed A record with a key I can no longer find keyTag=13946

root-dns.netcup.net. appears to have a signed SOA record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed NS record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed A record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed MX record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed TXT record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed AAAA record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed DNSKEY record with a key keyTag=21282

root-dns.netcup.net. appears to have a signed DNSKEY record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed NSEC3PARAM record with a key keyTag=51335

root-dns.netcup.net. appears to have a signed A record with a key I can no longer find keyTag=13946

Alles anzeigen

Die beiden werden zwar nur als Warnung ausgegeben, aber ich tendiere dazu alles "perfekt" zu haben.

Wenn mir jemand erläutern könnte was ich dagegen machen kann oder ob man sowas ignorieren kann, wäre das schon ziemlich klasse.

Vielen Dank!

mainziman · 3. März 2018

die DNS-Auflsg. beginnt von rechts nach links ...

Beispiel:

Code

www.example.com. <--- beachte den Punkt am Ende

das ist die sogenannte Root-Zone, diese beinhaltet diese

beinhaltet die sogenannten Root-Server, welche jeder Caching-DNS

als hint verwendet,

(hier zum anschauen: ftp://ftp.internic.net/domain/named.cache)

diese wissen, welcher DNS-Server f. die Zone darunter

eine Antwort kennt, hier .com

und dieser DNS-Server weiß welcher DNS-Server f. die domain .example.com.

authoritativ ist, nun ist es aber so, daß man bei einer Domain

DNS-Server haben kann, welche selbst zur Domain gehören¹,

und das sind die sogenannten glue-Einträge bei der darüiberliegenden Zone;

da aber alle Domains, welche bei netcup gehostet werden diese 3 DNS-Server haben

braucht auch niemand einen glue-Eintrag;

und die Sache mit DNSKEY hat was mit DNSSEC zu tun;

wenn dies nicht verwendet wird, was die meisten nicht verwenden; wird auch das nicht benötigt

¹das ist dann der Fall wenn z.B. ns1.example.com. f. die Domain example.com. authoritativ ist

Caspar · 3. März 2018

Moin,

vielen Dank für die gute Erklärung.

Nun nutze ich tatsächlich aktiv DNSSEC

Stört das in irgendeiner Weise?

Bisherige Tests sind, im Bezug zu DNSSEC, immer erfolgreich abgelaufen.