Bug#600642: Problem resolving debian.org with Comcast DNSSEC servers

[Anders Kaseorg <andersk@MIT.EDU>]

Package: www.debian.org

Using Comcast’s DNSSEC testing resolvers (75.75.75.75, 75.75.76.76) [1], I 
can’t resolve hosts in debian.org about half the time.

$ host security.debian.org 75.75.75.75
Using domain server:
Name: 75.75.75.75
Address: 75.75.75.75#53
Aliases: 

Host security.debian.org not found: 3(NXDOMAIN)

This is worrying in light of today’s announcement of Comcast’s planned 
migration of all customers to DNSSEC over the next few months; many Debian 
users might find themselves unable to get security updates.

I don’t know whether this is Debian’s fault or Comcast’s, but Verisign’s 
DNSSEC Debugger [3] does find a problem with the domain (“No DS records 
found for debian.org in the org zone”).

[1] http://www.dnssec.comcast.net/
[2] http://blog.comcast.com/2010/10/DNS-Security-Rollout-Begins.html
[3] http://dnssec-debugger.verisignlabs.com/debian.org