DNSSec entries still affected on my domain even though i've disable

0

Hello As the title says, so i've disable dnssec on my domain few month back but when i check on dnssec analyzer my domain dnssec still enabled. so i can't issue let's encrypt ssl cert

I've make sure both on my route53 and on my domain registrar disabled DNSSEC Analyzer result

DNSSec configuration on Route53

DNSSec configuration on my domain registrar

Let's encrypt error due dnssec

Abdilah
질문됨 10달 전289회 조회
4개 답변
0
수락된 답변

Thank you for the information Gary, i did contact my registrar which is PANDI and they escalate the "stuck" ds record from their side.

Abdilah
답변함 10달 전
  • Thanks for the update and glad I could help. I would appreciate it if you accepted my answer as this helps me and others. Gary

0

I already delete the DS record on my domain registrar long time ago, but i'll contact them to check on their side. will be update soon after i got answer from them

Abdilah
답변함 10달 전
  • Please do.. Thanks samdgea

0

So I already contact my domain registrar and confirms that dnssec is already unsigned (disabled) Their response

Abdilah
답변함 10달 전
  • Hi Samdgea, I updated my answer with more information..Basicly the registrar needs to escalate this issue

0

Looks to me like there’s still a DS record at the registrar. In the screen shot NS-746 name server has an issue.

# DS Records 

| Domain Name | TTL | Key Tag | Algorithm | Digest Type | Digest | 
|-------------|-----|---------|-----------|-------------|--------|
| Abdilah.id | 3600 | 54640 | 13 | 2 | 063B08C8F23150A315679A2EF6A220F5F56DA29DE738
AD51A32C5A071E1AE53B | 

I’ve read a few pages and it says to remove DS at the registrar and wait a day or 2 before removing dnssec from the zone.

Believe you need to check with your registrar to have this resolved

Update The registrar may say its disabled, however the Name servers for .ID still have DS records for your domain. Your registar needs to escalte this to Indonesian Internet Domain Name Administrator who manages the domain to clear down the stuck DS records. You could try to enable and disable DNSSEC again, it may help flush it through. OR Remove/put in fake the NS records for the domain, try DS lookup again and then put the real NS records back.

It looks like the registrar process to add and remove DS records failed

https://en.wikipedia.org/wiki/.id#:~:text=id%20is%20the%20Internet%20country,domain%20(ccTLD)%20for%20Indonesia.

gary@thinkpad:~$ dig abdilah.id

; <<>> DiG 9.16.1-Ubuntu <<>> abdilah.id
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 13114
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; OPT=15: 00 09 6e 6f 20 53 45 50 20 6d 61 74 63 68 69 6e 67 20 74 68 65 20 44 53 20 66 6f 75 6e 64 20 66 6f 72 20 61 62 64 69 6c 61 68 2e 69 64 2e ("..no SEP matching the DS found for abdilah.id.")
;; QUESTION SECTION:
;abdilah.id.                    IN      A

;; Query time: 369 msec
;; SERVER: 192.168.8.240#53(192.168.8.240)
;; WHEN: Thu Jun 29 08:40:30 BST 2023
;; MSG SIZE  rcvd: 89

gary@thinkpad:~$ dig abdilah.id DS

; <<>> DiG 9.16.1-Ubuntu <<>> abdilah.id DS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57801
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;abdilah.id.                    IN      DS

;; ANSWER SECTION:
abdilah.id.             3600    IN      DS      54640 13 2 063B08C8F23150A315679A2EF6A220F5F56DA29DE738AD51A32C5A07 1E1AE53B

;; Query time: 389 msec
;; SERVER: 192.168.8.240#53(192.168.8.240)
;; WHEN: Thu Jun 29 08:40:57 BST 2023
;; MSG SIZE  rcvd: 97
profile picture
전문가
답변함 10달 전
profile picture
전문가
검토됨 10달 전
  • I see the DS key has changed for your domain but DNS SEC Is still enabled for your domain

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인