how is DNSSEC broken for addons.cdn.mozilla.net ?
Summary
; <<>> DiG 9.11.5-P1 <<>> addons.cdn.mozilla.net +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29229
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;addons.cdn.mozilla.net. IN A;; ANSWER SECTION:
addons.cdn.mozilla.net. 59 IN CNAME addons-cdn-geo.prod.mozaws.net.
addons.cdn.mozilla.net. 59 IN RRSIG CNAME 7 4 60 20190115013849 20190112003849 41873 mozilla.net. dBv7XEP3BKl/9RgtKF5/98ac6AIV9TPFV2WnGx2RrAqFCk273zsvtxGB 2pZZE07nyjFOZ8b3kG+dU4GPXyEgEVcEAHIqAyV+kUn/RunFVCw1x 57u /pnrFoZcanPR6R1YfTynuqGYs++CemxYhNM+BmtqtF7Kxio3ee05q9Lf Ez0=
addons-cdn-geo.prod.mozaws.net. 299 IN CNAME d1sp2sgy246t7c.cloudfront.net.
d1sp2sgy246t7c.cloudfront.net. 60 IN A 13.249.9.62;; Query time: 976 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; MSG SIZE rcvd: 319
You sure it is not the upstream DNS server kresd is querying that is delivering a broken DNSSEC response?