medicare.gov / cms.gov DNSSEC Validation Failures

Thu Dec 30 13:17:02 UTC 2010

In message <1293658659.2817.17.camel at watermelon.coderich.net>, Richard Laager w
> On Wed, 2010-12-29 at 12:32 -0500, Christopher J. Pilkington wrote:
> > On Tue, Dec 28, 2010 at 06:39:21PM -0600, Richard Laager wrote:
> > > I'm looking for a DNS contact for medicare.gov (and cms.gov). They are
> > > failing DNSSEC validation.
> >=20
> > Seeing it still broken, I contacted someone over at Lockheed who
> > works over at CMS.  They're escalating to "the appropriate
> > support vendor."
> 
> Thank you both for forwarding this. Some progress has been made:
> 
> I received a response saying they believed they had it fixed. From my
> testing, medicare.gov is fixed, but cms.gov is still broken (though in a
> different way, I think). I replied as such and also requested corrected
> SOA records.
> 
> Thanks again,
> Richard

Correct cms.gov is still broken the DS records don't match any of the
DNSKEY records.  10672 != 12456 or 27229

Mark

; <<>> DiG 9.6.0-APPLE-P2 <<>> ds cms.gov
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21811
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cms.gov.			IN	DS

;; ANSWER SECTION:
cms.gov.		30410	IN	DS	10672 5 1 F11F940C51B90CEB818350F1C7049DD8D54050D8
cms.gov.		30410	IN	DS	10672 5 2 A99B67A100FD5EFD0E393FD0C87A6B00424B6A4A032637BC7A11D732 E05AD5BB

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Dec 31 00:12:23 2010
;; MSG SIZE  rcvd: 109

; <<>> DiG 9.6.0-APPLE-P2 <<>> +cd dnskey +multi cms.gov
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62756
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cms.gov.		IN DNSKEY

;; ANSWER SECTION:
cms.gov.		349199 IN DNSKEY 256 3 5 (
				AwEAAaSsgUpPtXC4xOHnX//jDm4d4xegc9zupcXwICfm
				4jeBD+ZNHJeTSrxPnILqDb310Jxy6UDi6ye0ipOWG8z6
				b1oOwmF8LRnpWs+bi9X+AivagVXP2xQQe/pev8KrmMFs
				UcLZ1PX4w+GxNgsoUGre235fv9IM/EfdD33zSNxeA463
				) ; key id = 12456
cms.gov.		349199 IN DNSKEY 257 3 5 (
				AwEAAbZbZW7J+O5/tSwDVrGsv5KDDB7HvItDVeQLvdpr
				GdyJPVlUvs+u87hsCDU96SwmicXTDGdWZFDmj3x22O4p
				dERsrKoKYpOAoNR3VLgXMToRZmUnaLZf/MqO+H/54PE7
				Ij7oorWmPJpIZrYzn28MMIiOkH1xOS7eDL2NZ4q06oDN
				vSDefX3HA5i2sUcOureEFUo6gUkLFkY/uPJ3y35A8uz1
				KvGd4851UAEfq76sawDl+3uKzETDS5grwmK58NbKKB2O
				5SAcAS3OxBMriKLUHjsPpwoxKoG5Mc+jA0egIn7tUAQU
				zzI0HHnspZvZUEbW18uMTFAQX2du2eyGcMwvGEs=
				) ; key id = 27229

;; Query time: 304 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Dec 31 00:12:47 2010
;; MSG SIZE  rcvd: 449

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org