Undelegated test with empty ds_info

[stinovlas]

Hi!

We're using Zonemaster to perform undelegated tests of domains in a zone. We'd like to be able to perform undelegated tests for domains that don't have any dnskeys. However, when I send a request to start_domain_test with ds_info: [], it seems that Zonemaster checks DNSKEY and DS records in the zone. Is there any way to actually convince Zonemaster that list of keys is empty and there should be no autodetection scan performed?

[matsduf]

Zonemaster never checks for DS in the zone, but in the parent zone. If the test is an undelegated test and no DS is provided Zonemaster will take that as there is no DS in the parent zone. By default Zonemaster will check for DNSKEY in the zone, but if you run your own installation including zonemaster-cli, then you can create a custom profile with no DNSSEC test cases and use that.

How do you run Zonemaster?

[stinovlas]

We run our own instance at https://zonemaster.nic.cz/. I think I'm beginning to understand.

1. If I perform undelegated test and provide DS records, Zonemaster checks whether provided DS matches DNSKEY in the child zone if it does not, it produces ERROR in DNSSEC02: DS must match a valid DNSKEY in the child zone.
2. If I perform undelegated test and provide no DS records, Zonemaster still checks whether DNSKEY records are valid, but does not check that DS in the parent zone matches DNSKEY in the child zone.
3. If I perform delegated test, Zonemaster checks if DS record in the parent zone matches DNSKEY in the child zone.

Zonemaster considers test undelegated if I provide non-empty nameservers in the request params.

Is that correct?

[matsduf]

@stinovlas, sorry for late reply.

Yes, your interpretations are correct.

[matsduf]

Discussion completed.