Route53 DNSSEC VPC activation: no 'ad' flag with dig

Question

Hi, I've activated DNSSEC on a VPC and I'm checking it's working from an Amazon Linux EC2 machine created inside this VPC. I know that it's working since a can't resolve 'dnssec-failed.org' anymore.

But 'dig' does not show me the expected 'ad' (Authenticated Data) flag nor the 'RRSIG' record when resolving a DNSSEC compatible domain:

[ec2-user@ip-10-0-4-82 ~]$ dig internetsociety.org +dnssec
; <<>> DiG 9.18.28 <<>> internetsociety.org +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5907
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;internetsociety.org.           IN      A

;; ANSWER SECTION:
internetsociety.org.    300     IN      A       104.18.17.166
internetsociety.org.    300     IN      A       104.18.16.166

;; Query time: 20 msec
;; SERVER: 10.0.0.2#53(10.0.0.2) (UDP)
;; WHEN: Sun Sep 29 14:45:31 UTC 2024
;; MSG SIZE  rcvd: 80

Using the Google DNS from the same EC2 machine, it works:

[ec2-user@ip-10-0-4-82 ~]$ dig internetsociety.org +dnssec @8.8.8.8

; <<>> DiG 9.18.28 <<>> internetsociety.org +dnssec @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15976
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;internetsociety.org.           IN      A

;; ANSWER SECTION:
internetsociety.org.    300     IN      A       104.18.16.166
internetsociety.org.    300     IN      A       104.18.17.166
internetsociety.org.    300     IN      RRSIG   A 13 2 300 20240930154542 20240928134542 34505 internetsociety.org. KsY2byTH8jb6Gg1yXuDzjkA+FDM343a/OV5mEDWx5ws3g2Wqm3D+xW6a j6gHTkgMgBnWwKF06l9JqCFF+PQNsw==

;; Query time: 20 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Sun Sep 29 14:45:42 UTC 2024
;; MSG SIZE  rcvd: 195

Any idea why such a behavior ?

BR, Damien.

Jerome GUYON · Answer

Hello, 
From https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dnssec-validation.html :
> At this time, the Amazon Route 53 Resolver in your VPC (aka AmazonProvidedDNS) ignores the DO (DNSSEC OK) EDNS header bit and the CD (Checking Disabled) bit in the DNS query. If you have configured DNSSEC, this means that while the Route 53 Resolver does perform DNSSEC validation, it doesn't return DNSSEC records nor set the AD bit in the response. Therefore, performing your own DNSSEC validation is not currently supported by the Route 53 Resolver. If you need to do this you will have to perform your own recursive DNS resolution.

I guess it explain the observed behavior without ad flag nor RRSIG record

Route53 DNSSEC VPC activation: no 'ad' flag with dig

Add your answer

Relevant content