{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/413","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/413/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/413/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/413/events","html_url":"https://github.com/letsencrypt/boulder/pull/413","id":91097942,"number":413,"title":"Remove local DNSSEC checking","user":{"login":"rolandshoemaker","id":5080674,"avatar_url":"https://avatars.githubusercontent.com/u/5080674?v=3","gravatar_id":"","url":"https://api.github.com/users/rolandshoemaker","html_url":"https://github.com/rolandshoemaker","followers_url":"https://api.github.com/users/rolandshoemaker/followers","following_url":"https://api.github.com/users/rolandshoemaker/following{/other_user}","gists_url":"https://api.github.com/users/rolandshoemaker/gists{/gist_id}","starred_url":"https://api.github.com/users/rolandshoemaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rolandshoemaker/subscriptions","organizations_url":"https://api.github.com/users/rolandshoemaker/orgs","repos_url":"https://api.github.com/users/rolandshoemaker/repos","events_url":"https://api.github.com/users/rolandshoemaker/events{/privacy}","received_events_url":"https://api.github.com/users/rolandshoemaker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/needs-revision","name":"needs-revision","color":"5319e7"},{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/r%20needed","name":"r needed","color":"fad8c7"},{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/r=jcjones","name":"r=jcjones","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-25T22:58:04Z","updated_at":"2015-07-08T17:48:39Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/letsencrypt/boulder/pulls/413","html_url":"https://github.com/letsencrypt/boulder/pull/413","diff_url":"https://github.com/letsencrypt/boulder/pull/413.diff","patch_url":"https://github.com/letsencrypt/boulder/pull/413.patch"},"body":"This is a follow-up to #405 and #406 from yesterday. #406 only removed the `LookupHost` checks and didn't touch the underlying `LookupDNSSEC` usage that remained in use in `validateDNS` and `CheckCAARecords` (and the base DNS methods in `core/dns.go` these functions were calling).\r\n\r\nThis PR removes `LookupDNSSEC` and just fails on SERVFAIL from the upstream resolver. It also clears out the usage of `core.DNSSECError` and `core.DNSSECProblem`, and adds a method `parseDNSError` to retrieve slightly more useful information from the errors returned from `Lookup...` methods.\r\n\r\nI've added the `LookupHost` (without underlying `LookupDNSSEC` logic) checks back in so we can differentiate between SERVFAIL and unknown host before `client.Do(httpRequest)` and `tls.DialWithDialer` since these will only tell us if the DNS connection timed out. (Although I'll happily be convinced this isn't necessary)\r\n\r\nI've changed `LookupCAA` to return an empty list of CAA records on SERVFAIL after a conversation with @bifurcation, this will allow testing with DNS servers that don't support CAA queries (looking at you Cloudflare) for now but should probably be changed/reverted eventually... If we can configure the production resolver to return REFUSED for rejected queries and   SERVFAIL for validation/other resolver failures then we can change the behavior to return an empty list on the former and fail with a validation error on the latter to be cleaner. \r\n\r\nFinally I've also added timeout checks to all of the live DNS tests in `core/dns_test.go` and `va/validation-authority_test.go` until #401 is resolved as the timeout errors both locally and on travis have started getting kind of annoying recently when using `8.8.8.8`.\r\n\r\nPing @bifurcation @jcjones."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/119675542","html_url":"https://github.com/letsencrypt/boulder/pull/413#issuecomment-119675542","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/413","id":119675542,"user":{"login":"jcjones","id":518542,"avatar_url":"https://avatars.githubusercontent.com/u/518542?v=3","gravatar_id":"","url":"https://api.github.com/users/jcjones","html_url":"https://github.com/jcjones","followers_url":"https://api.github.com/users/jcjones/followers","following_url":"https://api.github.com/users/jcjones/following{/other_user}","gists_url":"https://api.github.com/users/jcjones/gists{/gist_id}","starred_url":"https://api.github.com/users/jcjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcjones/subscriptions","organizations_url":"https://api.github.com/users/jcjones/orgs","repos_url":"https://api.github.com/users/jcjones/repos","events_url":"https://api.github.com/users/jcjones/events{/privacy}","received_events_url":"https://api.github.com/users/jcjones/received_events","type":"User","site_admin":false},"created_at":"2015-07-08T17:48:39Z","updated_at":"2015-07-08T17:48:39Z","body":"Given the above, and all the work that has been done on these tests in #438, why don't you rebase this changeset on #438 while resolving the issues. That puts most of the VA tests you've modified in this PR back to working as intended without the changes."}}