NSEC with DS/NS-holding owner name appears to be signed by child zone

[cwchristerw]

https://dnsviz.net/d/dns.christerwaren.fi/Y_KfPg/dnssec/
https://dnsviz.net/d/dnsc.christerwaren.fi/Y_KaQg/dnssec/

[Habbie]

The first error under Notices on the first dnsviz URL is suspect.

Unbound, dnsviz, possibly systemd-resolved are unhappy about this. Recursor appears to be happy (which might be a bug).

[cwchristerw]

When I created TXT record devices0.christerwaren.fi to christerwaren.fi zone it started work properly according to DNSViz but ...
https://dnsviz.net/d/dns.christerwaren.fi/Y_KoIA/dnssec/
https://dnsviz.net/d/devices0.christerwaren.fi/Y_Kkww/dnssec/

after removing it problem returns.
https://dnsviz.net/d/dns.christerwaren.fi/Y_Ksbw/dnssec/
https://dnsviz.net/d/devices0.christerwaren.fi/Y_KttA/dnssec/

[rgacogne]

The answer I get from the authoritative server when asking for dns.christerwaren.fi|A is:

; <<>> DiG 9.18.11 <<>> dns.christerwaren.fi @51.255.223.60 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30170
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 2, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;dns.christerwaren.fi.		IN	A

;; ANSWER SECTION:
onyx.devices.christerwaren.fi. 3600 IN	RRSIG	A 13 4 3600 20230302000000 20230209000000 24595 devices.christerwaren.fi. +P3TOytQuvS4970eWYVvIB6hk4veCJhgJOv0QHSG50coZKxahSYgQG2f uGOWafLZ6LJuf3p3hyujaVUMKY5Nrg==
onyx.devices.christerwaren.fi. 3600 IN	A	164.132.7.242
dns.christerwaren.fi.	3600	IN	RRSIG	CNAME 13 2 3600 20230302000000 20230209000000 33286 christerwaren.fi. MlqxkZsNs4P4pNulIy52pFVE8iwjzN52ND9FdGeCS2QdAC/cHtl6tYfU eZjAGiilux6Oc8g+NbU4NMPC9fMRgQ==
dns.christerwaren.fi.	3600	IN	CNAME	onyx.devices.christerwaren.fi.

;; AUTHORITY SECTION:
devices0.christerwaren.fi. 3600	IN	NSEC	dns1.christerwaren.fi. TXT RRSIG NSEC
devices0.christerwaren.fi. 3600	IN	RRSIG	NSEC 13 3 3600 20230302000000 20230209000000 33286 christerwaren.fi. 4/xIDy8WRXjnhJECKw6q6GZmKalJvCOJSiCt7d27o6usZPjp4Q9fA9tK ATXjAt6/SgZKjA3f0Bjhc8NxZLVwqQ==

There is indeed an issue with the NSEC in authority proving that the qname does not exist, while the answer section has a CNAME record for that same name.
But given that the answer section contains a valid, positive response, properly signed (with a correct signer), I'm not surprised we are not looking at the NSEC much. In that exact case it's even worse because the answer is an alias, and rfc2182 tells us that in such an answer we can pretty much only consider the CNAME record itself as authoritative (although it might only apply to records in the answer and additional sections, perhaps not authority).
When we follow the alias, the response is correct as well:

; <<>> DiG 9.18.11 <<>> onyx.devices.christerwaren.fi. @51.255.223.60 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35182
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;onyx.devices.christerwaren.fi.	IN	A

;; ANSWER SECTION:
onyx.devices.christerwaren.fi. 3600 IN	RRSIG	A 13 4 3600 20230302000000 20230209000000 24595 devices.christerwaren.fi. +P3TOytQuvS4970eWYVvIB6hk4veCJhgJOv0QHSG50coZKxahSYgQG2f uGOWafLZ6LJuf3p3hyujaVUMKY5Nrg==
onyx.devices.christerwaren.fi. 3600 IN	A	164.132.7.242

The signature is valid, and there is indeed a cut at devices.christerwaren.fi. so the signer is correct:

; <<>> DiG 9.18.11 <<>> devices.christerwaren.fi. @51.255.223.60 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48596
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;devices.christerwaren.fi.	IN	A

;; AUTHORITY SECTION:
devices.christerwaren.fi. 3600	IN	SOA	dns1.waren.io. info.waren.io. 2023021902 10800 3600 604800 3600
devices.christerwaren.fi. 3600	IN	RRSIG	SOA 13 3 86400 20230302000000 20230209000000 24595 devices.christerwaren.fi. Y/Mu0rOaA6+L+Zv3XkPXh/8iQZZauqUFSu+kZutAr4NTJdKanjG36PRX x4vua8/X1+lGnlLEIpjvHpq92EYrfQ==
devices.christerwaren.fi. 3600	IN	NSEC	echelon.devices.christerwaren.fi. NS SOA RRSIG NSEC DNSKEY
devices.christerwaren.fi. 3600	IN	RRSIG	NSEC 13 3 3600 20230302000000 20230209000000 24595 devices.christerwaren.fi. PY0yobWPC4MHhRFNoocl4nsyd23xqPGVzNWmJuV4Fs9CFuC9pZvcYwkP 127dE4J4y4YdJhptmfQhvqfF0pqUtQ==

[Habbie]

There is indeed an issue with the NSEC in authority proving that the qname does not exist, while the answer section has a CNAME record for that same name.

That's a wildcard proof, that seems fine (the RRSIG in ANSWER has label count 2). The setup you saw is, I think, entirely correct.

The problem occurs, as far as I can see, when Christer removes devices0 (which I suggested as a workaround), and an NSEC appears at devices, with NS+DS+RRSIG+NSEC in the bitmap (so, parent zone), but with the child zone signer name. https://dnsviz.net/d/dns.christerwaren.fi/Y_KfPg/dnssec/ says "RRSIG NSEC proving non-existence of dns.christerwaren.fi/CNAME alg 13, id 24595: The Signer's Name field of the RRSIG RR (devices.christerwaren.fi) does not match the name of the zone containing the RRset (christerwaren.fi)."

Try: dig +noidnout +noidnin a devices-.christerwaren.fi +dnssec +cd