Subject: Re: [dnsext] Deliberately bad DNSSEC for testing ?

From: Matthäus Wander <[email-masked]>
Date: Mon, 01 Jul 2013 10:27:06 +0200

* John Levine [2013-07-01 04:13]:
> Does anyone publish DNS records with deliberately broken DNSSEC so we
> can test that our DNSSEC-aware clients don't resolve them?

A records with broken DNSSEC:
dnssec-failed.org.
sigfail.verteiltesysteme.net.

Broken signatures over SOA but (currently?) without A record:
servfail.nl.
rhybar.cz.

Excellent reference with a lot of more examples:
http://dnssec-tools.org/testzone/index.html

Test websites which show result to the user:
http://www.dnssec-or-not.net/
http://dnssectest.sidn.nl/
https://labs.nic.cz/page/960/
http://dnssec.vs.uni-due.de/

I copied some links shamelessly from this list:
http://dnssec-deployment.org/pipermail/dnssec-deployment/2013-June/006623.html

Regards,
Matt

-- 
Universität Duisburg-Essen
Verteilte Systeme
Bismarckstr. 90 / BC 316
47057 Duisburg

---

From: Richard Lamb <[email-masked]>
Date: Mon, 1 Jul 2013 06:55:00 -0700

badsig.zx.com is another that I have run.  Its parent zx.com has a
deliberately bad DS record in it.

On Mon, Jul 1, 2013 at 1:27 AM, Matthäus Wander <[email-masked]
> wrote:

> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext
>
>