<div>I missed the trusted key .......... Thanks</div>
<div> </div>
<div>Here is the other output </div>
<div> </div>
<div> </div>
<div># dig +cd +dnssec <a href="http://dlv.isc.org">dlv.isc.org</a> dnskey @localhost</div>
<p>; <<>> DiG 9.6.2-P1-RedHat-9.6.2-3.P1.fc12 <<>> +cd +dnssec <a href="http://dlv.isc.org">dlv.isc.org</a> dnskey @localhost<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63788<br>
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1</p>
<p>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags: do; udp: 4096<br>;; QUESTION SECTION:<br>;<a href="http://dlv.isc.org">dlv.isc.org</a>. IN DNSKEY</p>
<p>;; ANSWER SECTION:<br><a href="http://dlv.isc.org">dlv.isc.org</a>. 6752 IN DNSKEY 256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7 GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9S BdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBF tCibp/mkhw==<br>
<a href="http://dlv.isc.org">dlv.isc.org</a>. 6752 IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh<br>
<a href="http://dlv.isc.org">dlv.isc.org</a>. 6752 IN RRSIG DNSKEY 5 3 7200 20100620033002 20100521033002 19297 <a href="http://dlv.isc.org">dlv.isc.org</a>. eEHtGjgatqIgxeCCcXJrZpaS5KzlWHbL/uNL9oqd/KnQwyVsqdZKhVR2 U9xcGmtu0GAUTdogSQvhzK92y1qF9FuLlmlBDc9pvLBCf5dc7kIJ61ey vOZi18iZIv9+MyoE2ex/KfAHdHZUp3TUzgen7iGxba/yt9/dcJE6iFhz Kk2FSxxG7PFgHRZZJl9aVxuPlNjCnm1gwnuvdKame73tZrlzAK3GBbTo IEE2QSKs47glxhF5/Xka4UqYZ7wSvuCPG/xFn67FXVOHFQvZjNBxWX3V H1jmoJhyLmpCI4JdwGBr7jwPDURDsL2iAUkfpPIuparlq6DwII3lzrqC gA1M6w==<br>
<a href="http://dlv.isc.org">dlv.isc.org</a>. 6752 IN RRSIG DNSKEY 5 3 7200 20100620033002 20100521033002 64263 <a href="http://dlv.isc.org">dlv.isc.org</a>. TbUCfqArddr/0K7NVhL+UNQuM2dDremcvzLbWz6odZzIwdC/MqHzzAj6 rbgHT+uwGZ6t+4ec5Hts9VWh+BEyx5pi6lnhKJjwcFwrXiBauppce11P uWG3AiJZeiYoCWu2E4CqhpW96ZrycRQYehWfsmDsR1BCglVytxJwYUhT WMg=</p>
<p>;; Query time: 4 msec<br>;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Thu May 20 21:52:59 2010<br>;; MSG SIZE rcvd: 936<br><br><br></p>
<div class="gmail_quote">On Thu, May 20, 2010 at 6:45 PM, Mark Andrews <span dir="ltr"><<a href="mailto:marka@isc.org">marka@isc.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote"><br>In message <<a href="mailto:AANLkTikyZnh9_CGPb2EFYE_-yuU4N3bs75Fwzp-jZQRz@mail.gmail.com">AANLkTikyZnh9_CGPb2EFYE_-yuU4N3bs75Fwzp-jZQRz@mail.gmail.com</a>>, itse<br>
<div>
<div></div>
<div class="h5">rvices88 writes:<br>> Hi,<br>><br>> Whenever i enable:<br>><br>> dnssec-lookaside "." trust-anchor "<a href="http://dlv.isc.org/" target="_blank">DLV.ISC.ORG</a>";<br>><br>
> in the named.conf, restart bind, the dns resolution stops. One the same FC12<br>> machine, dig using an outside dns server has no issues resolving with<br>> +dnssec option. I am using bind 9.6.2 that came with FC12.<br>
><br>> Any thoughts ?<br>><br>> -dani<br><br></div></div>Have you added the trusted-keys clause for <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>?<br><br>trusted-keys {<br> <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URkY62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboMQKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VStTDN0YUuWrBNh";<br>
};<br><br>Does "dig +cd +dnssec <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a> dnskey" return RRSIGS.<br><br>e.g.<br>; <<>> DiG 9.3.6-P1 <<>> +cd +dnssec <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a> dnskey<br>
;; global options: printcmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14675<br>;; flags: qr rd ra ad cd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1<br>
<div class="im"><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags: do; udp: 4096<br>;; QUESTION SECTION:<br></div>;<a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. IN DNSKEY<br><br>
;; ANSWER SECTION:<br><a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. 2077 IN DNSKEY 256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7 GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9S BdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBF tCibp/mkhw==<br>
<a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. 2077 IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh<br>
<a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. 2077 IN RRSIG DNSKEY 5 3 7200 20100619164502 20100520164502 19297 <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. OKURcBkX5iiDC1q87HsSs2xDcDrMm5aPAlYHkPqkHCy7UyTOnCr6cwwN W42mdG4nmpURR4aDGiPlfc1lomE5kA5wOcXASgfMO8eQoOOIyZcBngOb WaE0KY+e/xU37kf7Ms7g6UxTnL+hcjbYgZf2rwN7J1RXf0Z5PfyyASXi ybf3iYGs7GusXgLZ0ZEWQh0zglo2ym56CVt2TbIljJFB0lzAvezos36R SWAYfLLsfGp3v9WfG7e3D8nLvbq5D7+K3IciELr73TVly924uwfAQeEa df40dVR6qyQ++/HWaGr1wOIGLQBRzTX8gKK9RlmcHHcIZo0EFPJo0mf7 Abqpxw==<br>
<a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. 2077 IN RRSIG DNSKEY 5 3 7200 20100619164502 20100520164502 64263 <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a>. LZd6TanU48C2BNKZhuj4vMyquNE9mnbUmk9Zy+NbIKPmJ+h2uLq2EonO GfUkxku7ZPky9DnJ3O05gwcEbVrFDjqtK+hcweu7x+wu0OaXJNsVRJ69 wQpQEkVNgoPNYsHQ6ru65ZwmOm8yRvr/1lXhbJId6j0Y2QZVXvCzVGuA 58Q=<br>
<br>;; Query time: 1 msec<br>
<div class="im">;; SERVER: 127.0.0.1#53(127.0.0.1)<br></div>;; WHEN: Fri May 21 11:45:00 2010<br>;; MSG SIZE rcvd: 936<br><font color="#888888"><br>--<br>Mark Andrews, ISC<br>1 Seymour St., Dundas Valley, NSW 2117, Australia<br>
PHONE: +61 2 9871 4742 INTERNET: <a href="mailto:marka@isc.org">marka@isc.org</a><br></font></blockquote></div><br>