upvote

points

by traceroute6611 hours ago |
comments
upvoteby quicksilver0310 hours ago|
next
[-]
I happen to run an affordable EU supplier who does DNSSEC, and also AXFR (incoming and outgoing). I offer a free plan from time to time, but not at the moment to preserve resources for paying customer.

https://www.ptrdns.net/

reply
upvoteby andreaso9 hours ago|
parent|
[-]
Are you aware that the child zone A(AAAA) records for danube.ns.ptrdns.net differs from the parent zone A(AAA) glue records for danube.ns.ptrdns.net?

Looks like it's the glue records that point to the actual server?

reply
upvoteby Stitch42237 hours ago|
prev|
next
[-]
We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head.

Netnod.se uses a DNSKEY that is too small on their main domain.

Rcodezero.at might indeed be something. Thanks.

We donate to deSEC, so it’s not free for us.

reply
upvoteby traceroute667 hours ago|
parent|
[-]
> Netnod.se uses a DNSKEY that is too small on their main domain.

Interesting, could you expand on that ?

I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ?

[1] https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se

reply
upvoteby Stitch42233 hours ago|
parent|
[-]
Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3]

Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength.

Verisign does check for key validity but not for key strength / length as seen in your link.

[1] https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176

reply
upvoteby amaccuish11 hours ago|
prev|
[-]
One who doesn't is frustratingly Hetzner.
reply