Page MenuHome GnuPG

Use pool.sks-keyservers.net directly as default in dirmngr.conf-skel (instead of the CNAME)
Closed, ResolvedPublic

Description

Currently the default keyserver in the conf-skel file is:
hkp://keys.gnupg.net

Apparently it is a CNAME of pool.sks-keyservers.net (on ns1.openit.de).

I wonder why we rely on the CNAME (and that DNS server) as default instead of
using pool.sks-keyservers.net directly.

For example, my router seems to have issue with it and does not even know to
timeout. (I have to admit this apparently is a bug of my router's firmware
though, since if I have any nameserver instead of my router in resolv.conf, it
seems to work)

According to drill the CNAME is the only entry on that server and the AUTHORITY
section and ADDITIONAL section is empty:

[tom@localhost ~]$ drill keys.gnupg.net @ns1.openit.de
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 59794
;; flags: qr aa rd ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; keys.gnupg.net. IN A

;; ANSWER SECTION:
keys.gnupg.net. 86400 IN CNAME pool.sks-keyservers.net.

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 263 msec
;; SERVER: 217.69.65.35
;; WHEN: Fri Nov 27 23:48:50 2015
;; MSG SIZE rcvd: 66

Comparing to my local yahoo (which works fine with my router), I wonder if that
is a good way to implement the CNAME:

[tom@localhost ~]$ drill hk.yahoo.com @ns1.yahoo.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 8124
;; flags: qr aa rd ; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 2
;; QUESTION SECTION:
;; hk.yahoo.com. IN A

;; ANSWER SECTION:
hk.yahoo.com. 300 IN CNAME fd-fp3.wg1.b.yahoo.com.

;; AUTHORITY SECTION:
wg1.b.yahoo.com. 172800 IN NS yf4.a1.b.yahoo.net.
wg1.b.yahoo.com. 172800 IN NS yf2.yahoo.com.
wg1.b.yahoo.com. 172800 IN NS yf1.yahoo.com.
wg1.b.yahoo.com. 172800 IN NS yf3.a1.b.yahoo.net.

;; ADDITIONAL SECTION:
yf1.yahoo.com. 86400 IN A 68.142.254.15
yf2.yahoo.com. 86400 IN A 68.180.130.15

;; Query time: 157 msec
;; SERVER: 68.180.131.16
;; WHEN: Sat Nov 28 00:00:25 2015
;; MSG SIZE rcvd: 175

Event Timeline

Because a CNAME gives us much more flexibility than using the currently most
favored pool.

The response from the DNS server is fully okay. There can't be any additional
info because the CNAME points to a different zone.

You should have told us the OS and GnuPG version you are using. For example 2.1
uses a very different strategy than older versions.

werner claimed this task.
werner added a project: Won't Fix.