<div><div dir="auto">I have forwarded this to my contacts at Microsoft.</div></div><div><br><div class="gmail_quote"><div dir="ltr">On Tue, Sep 11, 2018 at 12:06 AM Mark Andrews <<a href="mailto:marka@isc.org">marka@isc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">While we are talking about DNS server that are broken, Microsoft your servers are as well. As none<br>
of the zones you serve are DNSSEC signed there isn’t as much breakage possible but there are still<br>
interoperability problems and unnecessary additional traffic. It’s not like the EDNS specification<br>
is complicated.<br>
<br>
The microsoftonline servers will cause DNSSEC validation to fail if they ever serve a DNSSEC signed<br>
zone in this state. The FORMERR will cause EDNS servers to fallback to plain DNS and the validators<br>
won’t get the records they need.<br>
<br>
The azure servers cause problems for anyone deploying a new EDNS options as they have to cope with<br>
your servers incorrectly echoing back the option. Additionally if EDNS(1) is ever deployed there is<br>
a good chance that resolvers will assume the broken answers indicate that there is no data at the<br>
name.<br>
<br>
Mark<br>
<br>
<a href="http://cityofharrison-mi.gov" rel="noreferrer" target="_blank">cityofharrison-mi.gov</a>. @<a href="http://207.46.15.59" rel="noreferrer" target="_blank">207.46.15.59</a> (<a href="http://ns1.bdm.microsoftonline.com" target="_blank">ns1.bdm.microsoftonline.com</a>.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=formerr,echoed edns1opt=formerr,version-not-zero,echoed do=ok ednsflags=ok optlist=formerr,subnet signed=ok ednstcp=ok<br>
<a href="http://cityofharrison-mi.gov" rel="noreferrer" target="_blank">cityofharrison-mi.gov</a>. @2a01:111:f406:1804::59 (<a href="http://ns1.bdm.microsoftonline.com" target="_blank">ns1.bdm.microsoftonline.com</a>.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=formerr,echoed edns1opt=formerr,version-not-zero,echoed do=ok ednsflags=ok optlist=formerr,subnet signed=ok ednstcp=ok<br>
<a href="http://cityofharrison-mi.gov" rel="noreferrer" target="_blank">cityofharrison-mi.gov</a>. @<a href="http://191.232.83.138" rel="noreferrer" target="_blank">191.232.83.138</a> (<a href="http://ns3.bdm.microsoftonline.com" target="_blank">ns3.bdm.microsoftonline.com</a>.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=formerr,echoed edns1opt=formerr,version-not-zero,echoed do=ok ednsflags=ok optlist=formerr,subnet signed=ok ednstcp=ok<br>
<a href="http://cityofharrison-mi.gov" rel="noreferrer" target="_blank">cityofharrison-mi.gov</a>. @2a01:111:f406:b400::22 (<a href="http://ns3.bdm.microsoftonline.com" target="_blank">ns3.bdm.microsoftonline.com</a>.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=formerr,echoed edns1opt=formerr,version-not-zero,echoed do=ok ednsflags=ok optlist=formerr,subnet signed=ok ednstcp=ok<br>
<a href="http://cityofharrison-mi.gov" rel="noreferrer" target="_blank">cityofharrison-mi.gov</a>. @<a href="http://157.56.81.41" rel="noreferrer" target="_blank">157.56.81.41</a> (<a href="http://ns2.bdm.microsoftonline.com" target="_blank">ns2.bdm.microsoftonline.com</a>.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=formerr,echoed edns1opt=formerr,version-not-zero,echoed do=ok ednsflags=ok optlist=formerr,subnet signed=ok ednstcp=ok<br>
<a href="http://cityofharrison-mi.gov" rel="noreferrer" target="_blank">cityofharrison-mi.gov</a>. @2a01:111:f406:3403::41 (<a href="http://ns2.bdm.microsoftonline.com" target="_blank">ns2.bdm.microsoftonline.com</a>.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=formerr,echoed edns1opt=formerr,version-not-zero,echoed do=ok ednsflags=ok optlist=formerr,subnet signed=ok ednstcp=ok<br>
<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @<a href="http://13.107.24.7" rel="noreferrer" target="_blank">13.107.24.7</a> (ns3-07.azure-dns.org.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @2a01:111:4000::7 (ns3-07.azure-dns.org.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @<a href="http://13.107.160.7" rel="noreferrer" target="_blank">13.107.160.7</a> (ns4-07.azure-dns.info.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @2620:1ec:bda::7 (ns4-07.azure-dns.info.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @<a href="http://64.4.48.7" rel="noreferrer" target="_blank">64.4.48.7</a> (ns2-07.azure-dns.net.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @2620:1ec:8ec::7 (ns2-07.azure-dns.net.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @<a href="http://40.90.4.7" rel="noreferrer" target="_blank">40.90.4.7</a> (ns1-07.azure-dns.com.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
<a href="http://clintoncounty-ia.gov" rel="noreferrer" target="_blank">clintoncounty-ia.gov</a>. @2603:1061::7 (ns1-07.azure-dns.com.): dns=ok edns=ok edns1=noerror,badversion edns@512=ok ednsopt=echoed edns1opt=noerror,badversion do=ok ednsflags=ok optlist=ok,subnet signed=ok ednstcp=ok<br>
-- <br>
Mark Andrews, ISC<br>
<a href="https://maps.google.com/?q=1+Seymour+St.,+Dundas+Valley,+NSW+2117,+Australia&entry=gmail&source=g">1 Seymour St., Dundas Valley, NSW 2117, Australia</a><br>
PHONE: +61 2 9871 4742 INTERNET: <a href="mailto:marka@isc.org" target="_blank">marka@isc.org</a><br>
<br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Mehmet<br>+1-424-298-1903</div>