The RPKI code has the correct loop:

However at least here:

Both via this code:

Call this function:

So maybe replacing this with code that returns the complete set.

Another problem seems to be the use of do_resolve_a_aaaa in do_resolve_ns_ips for NS that have multiple A or AAAA records:

This seems to be a bug. The intent of the RPKI subtest was to check all IP's also of the servers:

• Land RPKI tests in Internet.nl #613
• https://github.com/internetstandards/Internet.nl/releases/tag/v1.5.0

Odd to discover this only now. Do we want to have this fixed in 1.9 (because from that release on RPKI will have score impact)?

Some useful scripting to use the https://tranco-list.eu/ to find stuff:

curl -sSfLA '' "https://tranco-list.eu/download_daily/$(curl 'https://tranco-list.eu/latest_list' -sSfA '' -o /dev/null -w "%{redirect_url}\n" | cut -d/ -f5)" | bsdtar -Oxf- | cut -d, -f2 | tr -d '\r' > top-1m.list
head -n1000 top-1m.list | sed 's/$/ NS/g' | xargs dig +noall +answer > top1000ns
awk '{print $5}' top1000ns | sed 's/\.$/ A/g' | sort -u | xargs dig +noall +answer | awk '{l[$1]=l[$1]$5" ";n[$1]++}END{for(d in l){if(n[d]>1)print n[d], d, l[d]}}' | sort -nr > top1000ns-multi-ipv4

E.g. cloudflare.com both has 2 IPv4 and IPv6 addresses for the website and all nameservers, while the multiple IP addresses are displayed in the IPv6 nameserver section it's missing in the ROA existence.