I added 4 NS entries for a subdomain for a SalesForce email campaign.
SalesForce has since complained they see an "RRSIG
entry for the subdomain" and they "do not support (add to NS) RRSIG
records", and as such I need to remove it.
I did not add the RRSIG
entry - looks like it is automated? I do not see it in GoDaddy interface or in zone file. Can I remove it?
SalesForce directed me to a web tool (xnnd.com) that shows the offending record (last line)
email.example.com. 3600 IN NS ns4.exacttarget.com.
email.example.com. 3600 IN NS ns3.exacttarget.com.
email.example.com. 3600 IN NS ns2.exacttarget.com.
email.example.com. 3600 IN NS ns1.exacttarget.com.
email.example.com. 600 IN RRSIG NSEC 8 3 600 20220517140242 20220502140242.. (bunch of stuff...)
Per anx's comments and direction to DNSViz I see this error:
example.com to email.example.com: The server(s) for the parent zone (example.com) responded with a referral instead of answering authoritatively for the DS RR type.
I'm not sure if this is evidence of a problem or just an indicator that we have delegated DNS control for the subdomain to SalesForce. So still unclear where the issue lies.