Intermittent failures resolving .org domains in BIND 9.7.0 with DLV enabled

[Roy Badami]

A couple of weeks ago I upgraded my BINDs to 9.7.0 and enabled DLV.

This is my first time attemting to validate DNSSEC; however, I've been
seeing intermittent failures to resolve domains under .org which have
been frequent enough to force me to disable DLV again (hence
effectively disabling DNSSEC since I have no other trust anchors
configured).  The queries are resulting in SERVFAIL, and I'm pretty
sure the failures are DNSSEC-related, as when I've seen problems as
they occur (dig failing from the command line) then repeating the
query with the CD bit allowed it to succeed.

Has anyone else seen similar problems?  Could anyone give me any hints
as to what I can do to help debug this?  I started collecting dnssec
debug logs after the fist time it happened, but am open to suggestions
as to what else I should be logging.

I attach a fragment of dnssec debug logs relating to freebsd.org from
around the time that I was having problems receiving mail from that
domain.

Thanks in advance for any help,

    -roy


28-Mar-2010 18:35:58.811 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.811 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.811 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.811 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.811 dnssec: debug 9: validating @0x8307000: mx2.freebsd.org AAAA: finddlvsep: creating fetch for mx2.freebsd.org.dlv.isc.org DLV
28-Mar-2010 18:35:58.811 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: wait
28-Mar-2010 18:35:58.816 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: starting
28-Mar-2010 18:35:58.816 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: attempting negative response validation
28-Mar-2010 18:35:58.816 dnssec: debug 9: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: nsecvalidate: creating validator for dlv.isc.org SOA
28-Mar-2010 18:35:58.816 dnssec: debug 3:   validating @0x830b000: dlv.isc.org SOA: starting
28-Mar-2010 18:35:58.816 dnssec: debug 3:   validating @0x830b000: dlv.isc.org SOA: attempting positive response validation
28-Mar-2010 18:35:58.816 dnssec: debug 3:   validating @0x830b000: dlv.isc.org SOA: keyset with trust 8
28-Mar-2010 18:35:58.816 dnssec: debug 3:   validating @0x830b000: dlv.isc.org SOA: verify rdataset (keyid=64263): success
28-Mar-2010 18:35:58.816 dnssec: debug 3:   validating @0x830b000: dlv.isc.org SOA: marking as secure, noqname proof not needed
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validator @0x830b000: dns_validator_destroy
28-Mar-2010 18:35:58.817 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: in authvalidated
28-Mar-2010 18:35:58.817 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: resuming nsecvalidate
28-Mar-2010 18:35:58.817 dnssec: debug 9: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: nsecvalidate: creating validator for flame.org.dlv.isc.org NSEC
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x830b000: flame.org.dlv.isc.org NSEC: starting
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x830b000: flame.org.dlv.isc.org NSEC: attempting positive response validation
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x830b000: flame.org.dlv.isc.org NSEC: keyset with trust 8
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x830b000: flame.org.dlv.isc.org NSEC: verify rdataset (keyid=64263): success
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x830b000: flame.org.dlv.isc.org NSEC: marking as secure, noqname proof not needed
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validator @0x830b000: dns_validator_destroy
28-Mar-2010 18:35:58.817 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: in authvalidated
28-Mar-2010 18:35:58.817 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: looking for relevant nsec
28-Mar-2010 18:35:58.817 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: nsec range ok
28-Mar-2010 18:35:58.817 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: resuming nsecvalidate
28-Mar-2010 18:35:58.817 dnssec: debug 9: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: nsecvalidate: creating validator for org.dlv.isc.org NSEC
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x8306000: org.dlv.isc.org NSEC: starting
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x8306000: org.dlv.isc.org NSEC: attempting positive response validation
28-Mar-2010 18:35:58.817 dnssec: debug 3:   validating @0x8306000: org.dlv.isc.org NSEC: keyset with trust 8
28-Mar-2010 18:35:58.818 dnssec: debug 3:   validating @0x8306000: org.dlv.isc.org NSEC: verify rdataset (keyid=64263): success
28-Mar-2010 18:35:58.818 dnssec: debug 3:   validating @0x8306000: org.dlv.isc.org NSEC: marking as secure, noqname proof not needed
28-Mar-2010 18:35:58.818 dnssec: debug 3:   validator @0x8306000: dns_validator_destroy
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: in authvalidated
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: resuming nsecvalidate
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: in checkwildcard: *.org.dlv.isc.org
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: looking for relevant nsec
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: NSEC does not cover name, before NSEC
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: looking for relevant nsec
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: nsec range ok
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x830a000: mx2.freebsd.org.dlv.isc.org DLV: nonexistence proof(s) found
28-Mar-2010 18:35:58.818 dnssec: debug 3: validator @0x830a000: dns_validator_destroy
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: in dlvfetched: ncache nxdomain
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.818 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.819 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.819 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.819 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.819 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.843 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.843 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.856 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.856 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.871 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.871 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.892 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.892 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.908 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.908 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.930 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.930 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:58.944 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:58.944 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:59.042 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:59.042 dnssec: debug 3: validator @0x8307000: dns_validator_destroy
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: starting
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: plain DNSSEC returns unsecure (.): looking for DLV
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV mx2.freebsd.org.dlv.isc.org
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV freebsd.org.dlv.isc.org
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DNS_R_COVERINGNSEC
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: covering nsec found: 'freebsd.org.dlv.isc.org' 'flame.org.dlv.isc.org' '863.freenum.org.dlv.isc.org'
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: looking for DLV org.dlv.isc.org
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV not validated
28-Mar-2010 18:35:59.066 dnssec: debug 3: validating @0x8307000: mx2.freebsd.org AAAA: DLV lookup: no valid RRSIG
28-Mar-2010 18:35:59.066 dnssec: debug 3: validator @0x8307000: dns_validator_destroy