{"action":"created","issue":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/2432","labels_url":"https://api.github.com/repos/PowerDNS/pdns/issues/2432/labels{/name}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/2432/comments","events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/2432/events","html_url":"https://github.com/PowerDNS/pdns/issues/2432","id":69021231,"number":2432,"title":"Make check-zone warn about TLSA record preventing wildcard match for www record","user":{"login":"xolphin","id":11985378,"avatar_url":"https://avatars.githubusercontent.com/u/11985378?v=3","gravatar_id":"","url":"https://api.github.com/users/xolphin","html_url":"https://github.com/xolphin","followers_url":"https://api.github.com/users/xolphin/followers","following_url":"https://api.github.com/users/xolphin/following{/other_user}","gists_url":"https://api.github.com/users/xolphin/gists{/gist_id}","starred_url":"https://api.github.com/users/xolphin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xolphin/subscriptions","organizations_url":"https://api.github.com/users/xolphin/orgs","repos_url":"https://api.github.com/users/xolphin/repos","events_url":"https://api.github.com/users/xolphin/events{/privacy}","received_events_url":"https://api.github.com/users/xolphin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/PowerDNS/pdns/labels/auth","name":"auth","color":"eb6420"},{"url":"https://api.github.com/repos/PowerDNS/pdns/labels/feature%20request","name":"feature request","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2015-04-16T22:19:09Z","updated_at":"2015-04-17T10:46:24Z","closed_at":null,"body":"We managed to make our website unavailable by simply adding a DANE record to our DNS. This made NSEC3 prove non-existence of our www record, which made everyone using DNSSEC unable to use our website. I believe this is a bug inside PowerDNS, I haven't found any reason why this behavior should happen. We are running PowerDNS 3.4.3 with MySQL backend and Poweradmin interface.\r\n\r\nBefore the problem occurred we had basic records in our DNS. We did not have a 'www' record, but instead we used wildcard entry (*.example.net) pointing to our webservers IP. The zone used NSEC3 and everything was working fine.\r\n\r\nAfter entering a TLSA record to the zone (_443._tcp.www.example.net TLSA <dane info>), NSEC3 was suddenly proving non-existence of www.example.net. Making our website unavailable for everyone using DNSSEC or the Google DNS. Using 'pdnssec rectify-zone' did not help at all, and 'pdnssec check-zone' did not report any errors. \r\n\r\nAdding a www.example.net entry did fix this problem eventually. I can't find any reason why this should be required as the wildcard already points to the same address. \r\n\r\nThe bug was successfully reproduced on another domain on another server as well. "},"comment":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/comments/93963151","html_url":"https://github.com/PowerDNS/pdns/issues/2432#issuecomment-93963151","issue_url":"https://api.github.com/repos/PowerDNS/pdns/issues/2432","id":93963151,"user":{"login":"Habbie","id":525838,"avatar_url":"https://avatars.githubusercontent.com/u/525838?v=3","gravatar_id":"","url":"https://api.github.com/users/Habbie","html_url":"https://github.com/Habbie","followers_url":"https://api.github.com/users/Habbie/followers","following_url":"https://api.github.com/users/Habbie/following{/other_user}","gists_url":"https://api.github.com/users/Habbie/gists{/gist_id}","starred_url":"https://api.github.com/users/Habbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Habbie/subscriptions","organizations_url":"https://api.github.com/users/Habbie/orgs","repos_url":"https://api.github.com/users/Habbie/repos","events_url":"https://api.github.com/users/Habbie/events{/privacy}","received_events_url":"https://api.github.com/users/Habbie/received_events","type":"User","site_admin":false},"created_at":"2015-04-17T10:46:24Z","updated_at":"2015-04-17T10:46:24Z","body":"Ah, I see it, their text is a bit confusing. The NSEC3 it is talking about proves the -existence- of the name www, but also proves there is no data at www."}}