DNSSEC assessor depth + NSEC/NSEC3 scanning

[danielmichaels]

Part of #61 · Tier 6 · scanner assessor dnssec · Effort: M

Deepen DNSSEC assessment and wire up the dormant dnssec_compliance_findings table. Current assess_dnssec.go checks chain-present + deprecated algorithm only.

Checks to add

• DS-in-parent matches DNSKEY — validate the delegation chain to the parent (DS at registry corresponds to a published KSK).
• RRSIG validity window — flag RRSIGs near expiry or already expired (broken validation imminent).
• NSEC vs NSEC3 zone-walking exposure — NSEC permits trivial zone enumeration; flag NSEC (recommend NSEC3) and weak NSEC3 (low iteration / no opt-out where appropriate).
• Key-length adequacy (KSK/ZSK).
• Algorithm consistency / rollover sanity.
• Compliance framing → dnssec_compliance_findings.

Scanner change

• Collect NSEC/NSEC3 records (not currently fetched). The existing inline DNSSEC validation logic in scan_dnssec.go is already tagged // todo: move to assessor — good moment to refactor.

Cost flag

Extra DNSKEY/RRSIG/parent-DS queries — bounded, rate-limited.

Wiring

• scanner: collect NSEC/NSEC3 + parent DS
• extend assess_dnssec.go; wire dnssec_compliance_findings (sqlc, observer, UNION/service/UI)
• task sqlc; extend assess_dnssec_test.go

Decisions for owner

• Severity of NSEC zone-walking (medium?).
• RRSIG-expiry warning window.