Subject: DNSSEC validation problem with oss-auth.rii.dedyn.io

dynDNS at dedyn.io
1

Hello,

I’m experiencing a DNS resolution issue with oss-auth.rii.dedyn.io.

Normal DNS queries return SERVFAIL, while queries with DNSSEC checking disabled return the expected A record, 147.15.148.0.

The resolver reports the following error:

DNSSEC Bogus: failed to verify an insecure referral proof for oss-auth.rii.dedyn.io

Could you please check whether there is an issue with the DNSSEC validation chain, delegation, or associated DNS records for this hostname?

Thank you.

2

Hi @dysonperley,

Thanks for your message, and welcome to deSEC! :slight_smile:

Apologies – this domain name (which is already several weeks old) should not have been registered at all: Registrations under .dedyn.io normally are a direct subdomain (such as rii.dedyn.io), but yours is a subsubdomain.

This is not a use case we had intended to support.

(While it technically can be made to work, domain registration typically is about direct subdomains; consider .com, for example.)

Please contact support if youd like to switch to something like oss-auth-rii.dedyn.io instead.

Stay secure,
Peter

3

No I want to use the domain I already have registered

4

Hello, I’m having a DNSSEC validation issue with my hostname oss-auth.rii.dedyn.io.

When I query oss-auth.rii.dedyn.io through Cloudflare’s DNS resolver (1.1.1.1), I receive SERVFAIL with the following error:

DNSSEC Bogus: failed to verify an insecure referral proof for oss-auth.rii.dedyn.io.

However, when DNSSEC checking is disabled using the +cd flag, the hostname successfully resolves to 147.15.148.0. This suggests there may be an issue with the DNSSEC delegation or referral for this hostname.

The hostname was previously working for my service, and I would prefer to keep it rather than move to a different domain.

Could you please investigate the DNSSEC delegation and help me restore normal DNS resolution while keeping oss-auth.rii.dedyn.io and its existing A record pointing to 147.15.148.0?

Thank you for your help!

5

Hi,

As I said before, this use case is not supported, and the fact that you could register it is a bug on our side.

Stay secure,
Peter