<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 2010-02-25 17:07, Joe Baptista wrote:
<blockquote
cite="mid:874c02a21002250807p5457d961u216a7bb2214da099@mail.gmail.com"
type="cite">On Wed, Feb 24, 2010 at 10:23 PM, Alan Clegg <span
dir="ltr"><<a moz-do-not-send="true" href="mailto:aclegg@isc.org">aclegg@isc.org</a>></span>
wrote:<br>
<div class="gmail_quote">
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">Joe Baptista wrote:<br>
</div>
</blockquote>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im"> Serving signed zones requires signed zone data
to serve.<br>
Validation requires configuration of trust anchors.<br>
<br>
</div>
To "turn it off",<br>
<br>
Don't sign your zones and don't configure trust anchors.<br>
</blockquote>
<div><br>
Like I said the server is recursive only - no zones served. <br>
</div>
</div>
</blockquote>
Like Alan said (twice):<br>
<blockquote type="cite">
<pre wrap="">Serving signed zones requires signed zone data to serve.
Validation requires configuration of trust anchors.
</pre>
</blockquote>
For a recursive resolver, the first sentence is not applicable, but the
second is. To verify DNSSEC answers you need at least one trust anchor
configured. Ideally that would be the root-zone, but since that will
only be signed later this year, most people use a DLV.<br>
If you don't have a trust-anchor configured (the default), BIND will
ask DNSSEC answers, but won't validate them (since it can't), and will
thus accept anything just like a non-DNSSEC resolver..<br>
<br>
<blockquote
cite="mid:874c02a21002250807p5457d961u216a7bb2214da099@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Or,
if you think you might accidentally sign your zones or configure<br>
trust anchors, you can:<br>
<br>
dnssec-enable no;<br>
dnssec-validation no;<br>
</blockquote>
<div><br>
OK - so if I do the above - will that prevent my recursive server from
doing DNSSEC if it gets information from a DNSSEC signed zone?<br>
</div>
</div>
</blockquote>
Yes and no, It will prevent your resolver from asking DNSSEC answers.
Since DNSSEC is fully backward compatible, the server will not put
DNSSEC RRs in its reply. So your resolver will not know whether a zone
is DNSSEC or not.<br>
<br>
<br>
Niobos<br>
</body>
</html>