Ask
Reply
Solution
.png "Community Manager"){kind=icon}
I'm sorry the adviser didn't call you back when access to the system requied returned.
So we can help provide the information required, please send us your details by following the instructions in this private message and we'll be in touch.
Hi,
I've similarly migrated these past few days to Vodafone's Business FTTC broadband service from the Demon Business ADSL service, and have also had problems using the local DNSSEC-validating recursive resolver on my servers.
The problem appears to be that responses to UDP DNS queries from inside my local LAN are being corrupted in flight. Specifically, they appear to be being truncated to 512 bytes, I suspect by the local Vodafone router. I suspect that the NAT/firewall code on the local router is at fault., and this is preventing secure DNS resolution.
On my Linux server, located behind the provided Vodafone router, I can use the standard DNS query command 'dig' to demonstrate this problem.
For example, when I run `dig -t DNSKEY . @8.8.8.8`, I receive the following response:
;; Warning: Message parser reports malformed message packet. ; <<>> DiG 9.10.3-P4-Debian <<>> -t DNSKEY . @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58389 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: Message has 209 extra bytes at end ;; QUESTION SECTION: ;. IN DNSKEY ;; ANSWER SECTION: . 157119 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0= ;; Query time: 65 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Mon Apr 17 16:38:22 BST 2017 ;; MSG SIZE rcvd: 512
Note the bits I've highlighted in bold. These indicate that the response received from the external DNS server is malformed. Specifically, it could only extract one DNSKEY record from the response, and the size of the response message was exactly 512 bytes, and had more than 200 bytes at the end that it couldn't extract useful information from. If I change '8.8.8.8' to any other recursive DNS resolver, including the IP address of the local router, the same result occurs.
Compare exactly the same query retrieved from the same external recursive DNS resolver obtained over TCP:
; <<>> DiG 9.10.3-P4-Debian <<>> -t DNSKEY . @8.8.8.8 +tcp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27269 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;. IN DNSKEY ;; ANSWER SECTION: . 86233 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0= . 86233 IN DNSKEY 256 3 8 AwEAAZLsvvPf/WDYE8L8ZUOiXEN9PSg3Nqyqu8WWKVu4LIvPW77Y0W1m BgmroFEHxzA9zM2edQbYIFhj536sx3fj1bx4n8yKwQ0y1MYkXvgU3aKW f0jnm8qz5RPVa4iEUgP5og/70muAXmo38Ru10asc3SNtN2OlAT1Tivp+ U4JUlVA8ICvierUPg2Kgf2gtNFhuqMTx/IHrE5DdV+Z/rmHGqESe/mna DzHdFnKy7Ma5zcPTekmwZ86CnG+vNWMT6wiO56YSAaiHX0jSCjmkL7Jz T3xpp/vtoWLK1rir70i6NbsU48sPZOHLfhwzbownewAsng0QqMOcVcmh l6ifE3C/vjE= ;; Query time: 33 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Mon Apr 17 16:43:39 BST 2017 ;; MSG SIZE rcvd: 578
This works because the router is not incorrectly truncating the response to 512 bytes. Note that the true message size for the response to this query is 578 bytes, and that given the untruncated packet, `dig` is able to successfully retrieve both DNSKEY records for the DNS root zone.
This problem is forcing me to downgrade my DNS resolvers, because the larger query responses with the security keys and signatures needed for secure DNS resolution are being mishandled - even if the router isn't trying to handle the query directly handling itself. This is a potentially serious problem that could affect all kinds of DNS queries, not just those relating to DNSSEC.
I note that RFC 2671, the Internet standard that enables larger DNS responses, is now more than 17 years old. The routers Vodafone supplied to its customers really ought to be able to support such basic functionality. 
At the moment, I don't have a solution for this problem. Is there a power-users admin interface to the Vodafone routers that might expose additional functionality?
Kind regards,
--dwm
