Issue: Name huawei.com (SOA) not subdomain of zone cloud.huawei.com -- invalid response

[Cathy Almond]

On 01/06/2023 15:58, Jesus Cea wrote:
> I am getting errors "Name huawei.com (SOA) not subdomain of zone 
> cloud.huawei.com". The problem raises when requesting AAAA on 
> oauth-login.cloud.huawei.com . The problem was described in the mailing 
> list:
> 
> https://lists.isc.org/pipermail/bind-users/2021-January/104064.html
> 
> BIND is replying with a SERVFAIL. This is correct and appropriate. 
> Nevertheless resolvers like 8.8.8.8, 1.1.1.1, 9.9.9.9 and many (most) 
> other are not doing that SOA verification, so for users we are the 
> guilty, not Huawey, because "using Google it works!". In fact, we have a 
> big customer phone app failing because of this (yes, this seems to be a 
> bug with that app but, again, "with google it works!").
> 
> What can we do? Is possible to disable that check in bind?
> 
> We are using 9.16. We could upgrade to 9.18, if needed.
> 
> Thanks.
> 

Has this just started - as in, it worked before ... when?

It sounds like 'they changed something', possibly by accident (maybe 
adding more servers or changing their provisioning tools?), so it 
wouldn't hurt to let them know directly.