Open-Xchange: Recursor accepts unsigned, empty NXDOMAINs in secure zones

Hi! This is a slightly edited version of the email I sent to the project's security contacts on 2020-04-21. Open-Xchange confirmed it and asked me to resubmit it here. Subject: Recursor may be accepting unsigned, empty NXDOMAINs in secure zones I can easily reproduce this against Cloudflare's authoritative DNS (see below). I put "may be" in the subject because I'm uncomfortable sounding a red alert without checking another authoritative implementation, but I don't know something available off hand. Background: Cloudflare's authoritative DNS service has a funny issue where it will return an NXDOMAIN with no SOA or DNSSEC records if the query name has a : in it. (They know and don't want to change it.) Try it with anything -- :.cloudflare.com, foo:bar.mattnordhoff.net, whatever. ``` $ dig +dnssec +norecurse @dana.ns.cloudflare.com foo:bar.mattnordhoff.net ; <<>> DiG 9.17.1 <<>> +dnssec +norecurse @dana.ns.cloudflare.com foo:bar.mattnordhoff.net ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2420 ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;foo:bar.mattnordhoff.net. IN A ;; Query time: 3 msec ;; SERVER: 2606:4700:50::adf5:3a69#53(2606:4700:50::adf5:3a69) ;; WHEN: Tue Apr 21 20:23:38 UTC 2020 ;; MSG SIZE rcvd: 53 $ dig +dnssec +norecurse @dana.ns.cloudflare.com foo:bar.mattnordhoff.net ds ; <<>> DiG...