#2267·blocky

Wildcard NSEC validation uses original query name instead of CNAME target across unsigned→signed zone boundary

Author: PeterBeuCreated Sep 16, 2026Updated Sep 16, 2026

www.vice.com returns SERVFAIL with DNSSEC Bogus. The domain is unsigned and CNAMEs into savageplatform.go-vip.net, which is signed with a wildcard (*.go-vip.net). I suspect the wildcard NSEC validation fails because it checks whether the NSEC records cover the original query name (www.vice.com.) rather than the CNAME target (savageplatform.go-vip.net.). A name from an entirely different zone will never be covered by go-vip.net's NSEC records, so this always fails.

Version: v0.35.0 Build time: 20260905-163954

The zone security classification from #1926 works, Blocky correctly follows the CNAME across the unsigned to signed boundary. But the NSEC coverage check downstream still carries the original query name through instead of switching to the followed name.

www.vice.com.  (unsigned, no DS)
  → CNAME savageplatform.go-vip.net.  (signed, wildcard *.go-vip.net)

Expected

Blocky checks NSEC non-existence for savageplatform.go-vip.net. → wildcard *.go-vip.net applies → Secure → answer served.

Actual

I think blocky checks NSEC non-existence for www.vice.com. → not covered by go-vip.net NSEC records → Bogus → SERVFAIL.

Logs

[2026-09-16 11:18:07]  WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07]  WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07]  WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=A (www.vice.com.) req_id=76fc85d5-1010-4043-a8ec-4847965989aa
[2026-09-16 11:18:07]  INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=7 instance=blocky-m45ck question_name=www.vice.com. question_type=A response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS
[2026-09-16 11:18:07]  WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07]  WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07]  WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=AAAA (www.vice.com.) req_id=a0cc315c-2549-4ade-8770-485b3e62f49c
[2026-09-16 11:18:07]  INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=6 instance=blocky-m45ck question_name=www.vice.com. question_type=AAAA response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS
[2026-09-16 11:18:07]  WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07]  WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07]  WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=A (www.vice.com.) req_id=2110338d-1527-49f6-82f7-1d009264e58c
[2026-09-16 11:18:07]  INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=3 instance=blocky-m45ck question_name=www.vice.com. question_type=A response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS
[2026-09-16 11:18:07]  WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07]  WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07]  WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=AAAA (www.vice.com.) req_id=e57dd0e7-5d70-404e-beb2-08b4e7cd1758
[2026-09-16 11:18:07]  INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=3 instance=blocky-m45ck question_name=www.vice.com. question_type=AAAA response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS

dnsviz.net analysis:

Image

Config

dnssec:
  validate: true
  maxChainDepth: 15
  maxUpstreamQueries: 50
  maxNSEC3Iterations: 100
  cacheExpirationHours: 2

Related

  • #1926 similar about unsigned→signed CNAME , but addressed zone classification, not the NSEC name substitution
  • I don't think the transient/timeout fixes (#2120, #2127, #2139) are applicable here, the responses are very fast