DNSSEC10 tests for the existence of NSEC and NSEC3 records by sending a query for a non-existing name. The current specification (and its implementation) does not correctly handle the case when the non-existent name matches a wildcard name in the zone. A false error will be outputted:
$ zonemaster-cli --show-testcase --test DNSSEC/dnssec10 sebbe.eu
Seconds Level Testcase Message
======= ========= ============== =======
1.29 ERROR DNSSEC10 The name "xx--oplk4f3fgh9lksdfhu7h--xx.sebbe.eu." of RR type "A" is signed by RRSIG, but the signature or signatures cannot be verified. Fetched from the nameservers with IP addresses "185.86.106.232;193.187.91.106;2001:470:dff1:1:10::1;2001:470:dff1:1:10::2".
$ dig *.sebbe.eu +dns +mult
(...)
;; ANSWER SECTION:
*.sebbe.eu. 3555 IN A 185.86.106.232
*.sebbe.eu. 3555 IN A 193.187.91.106
*.sebbe.eu. 3555 IN RRSIG A 7 2 3600 (
20220407000000 20220317000000 47438 sebbe.eu.
oUVGtFNmf6chEm98KvhFMOO9ndiBi2/HI7dQegZBmDui
smXTDMOtcMnAzuv4aPH5/hX4M3jyTpRFc6Pe2IrsR56P
xLUXgTQG2uxAxOgzPj8wA4PhZjuEWGI+PshjD89EsAT9
J75E/pTI8azwaYuUhTI/e6PrHA8UmX6jVjziFYo= )
The purpose of the non-existent name is to get an NSEC or NSEC3 record, and not to handle the complexity of wildcard.
A simpler solution is to query for a non-existent record type of an existing name. That would be to query for NSEC3 in apex. That will result in a NODATA response for all compliant zones and nameservers, with an NSEC or NSEC3 record for apex (hash owner name in case of NSEC3) in the authority section.
DNSSEC10 should be updated to resolve the issue.
DNSSEC10 tests for the existence of NSEC and NSEC3 records by sending a query for a non-existing name. The current specification (and its implementation) does not correctly handle the case when the non-existent name matches a wildcard name in the zone. A false error will be outputted:
The purpose of the non-existent name is to get an NSEC or NSEC3 record, and not to handle the complexity of wildcard.
A simpler solution is to query for a non-existent record type of an existing name. That would be to query for NSEC3 in apex. That will result in a NODATA response for all compliant zones and nameservers, with an NSEC or NSEC3 record for apex (hash owner name in case of NSEC3) in the authority section.
DNSSEC10 should be updated to resolve the issue.