{"issue":{"state":"closed","pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"user":{"avatar_url":"https://secure.gravatar.com/avatar/ac71cdd8b5ef479a122ef6b72825082e?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"ac71cdd8b5ef479a122ef6b72825082e","url":"https://api.github.com/users/pawal","login":"pawal","id":285882},"milestone":null,"assignee":null,"labels":[],"updated_at":"2011-11-03T23:04:00Z","comments":6,"closed_at":"2011-11-03T23:04:00Z","url":"https://api.github.com/repos/tobez/validns/issues/7","body":"I get a lot of NSEC validation problems while testing the .se zone now, example:\r\n\r\n\r\n/home/pawal/antispam/se.new:10184434: NSEC says xn--ulrikskldblogg-dib.se. comes after xn--ulriksfrskringsblogg-jzb70b.se., but a.ns.xn--ulriksfrskringsblogg-jzb70b.se. does\r\n/home/pawal/antispam/se.new:10184443: NSEC says xn--ultraljudsskrmma-7nb.se. comes after xn--ulrikskldblogg-dib.se., but a.ns.xn--ulrikskldblogg-dib.se. does\r\n\r\nThis is the content of the zone file:\r\n\r\nxn--ulriksfrskringsblogg-jzb70b.se.     7200    IN      NSEC    xn--ulrikskldblogg-dib.se.  NS NSEC \\\r\nRRSIG\r\nxn--ulriksfrskringsblogg-jzb70b.se.     86400   IN      NS      a.ns.xn--ulriksfrskringsblogg-jzb70b\\\r\n.se.\r\na.ns.xn--ulriksfrskringsblogg-jzb70b.se.        86400   IN      A       178.73.224.237\r\nxn--ulrikskldblogg-dib.se.      7200    IN      RRSIG   NSEC  5  2  7200  20111110080515 (\r\n                        20111027170504 33951  se.\r\n                        QzarSfVI7VknY1PxQEO0ySkhpPoKg7BbzilsyoMVofVpH\r\n                        DA11Vsn2alwuaQkx6vxu2W1C2RyolEJG8fSmO8A4cxd9q\r\n                        EkWNoDJK8frkiN2PuCY3uI1u+BIiX1rxbVZO+qqk05hFr\r\n                        o6szHzZNtlmlWSoqaRedkf3h4i4iU0S/rudY= )\r\nxn--ulrikskldblogg-dib.se.      7200    IN      NSEC    xn--ultraljudsskrmma-7nb.se.  NS NSEC RRSIG\r\nxn--ulrikskldblogg-dib.se.      86400   IN      NS      a.ns.xn--ulrikskldblogg-dib.se.\r\na.ns.xn--ulrikskldblogg-dib.se. 86400   IN      A       178.73.238.252\r\nxn--ultraljudsskrmma-7nb.se.    7200    IN      RRSIG   NSEC  5  2  7200  20111111210454 (\r\n                        20111029190504 33951  se.\r\n                        J7MVJJhqYq/6GC53Pf2vmVLZI2XiRaPKvQY8oi7Y7OyxV\r\n                        f0avF6SrLaJ4+IMLUCVK+sV3Q2XyRPN7nnlib9BiTglaM\r\n                        QHsgdAujduQY4n35cl57p3rPwMmJIdScv0OZnWPQU1IIM\r\n                        GtpkIJqGZMLcC5/+P2WXCOTtXph2y/ArkgkM= )\r\n\r\nxn--ulriksfrskringsblogg-jzb70b.se. has been delegated (with the NS) so therefore a.ns.xn--ulriksfrskringsblogg-jzb70b.se is glue that should not be covered by NSEC.\r\n\r\nSee RFC 4034 section 4, and 4.1.1:\r\n\r\n   Owner names of RRsets for which the given zone is not authoritative\r\n   (such as glue records) MUST NOT be listed in the Next Domain Name\r\n   unless at least one authoritative RRset exists at the same owner\r\n   name.\r\n","html_url":"https://github.com/tobez/validns/issues/7","title":"Validation of NSEC chains seem buggy","number":7,"id":2097184,"created_at":"2011-10-31T14:01:22Z"},"action":"closed"}