<HTML>
<HEAD>
<TITLE>Dig +topdown</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>I set up a zone with dnssec, and wanted to verify that it was working properly. But I appear to have trouble with the root KSK.<BR>
<BR>
$ dig +dnssec danmcdonald.us +topdown<BR>
<BR>
;; No trusted key, +sigchase option is disabled<BR>
<BR>
; <<>> DiG 9.7.3-P1 <<>> +dnssec danmcdonald.us +topdown<BR>
<BR>
<BR>
<BR>
I appear to have the managed-keys-zone loading properly:<BR>
<BR>
In named.conf, I have the managed-keys stanza with the initial key. Named loaded the mananged-keys-zone file and loads the zone at startup:<BR>
01-Jul-2011 08:40:54.738 general: info: managed-keys-zone ./IN: loaded serial 2<BR>
<BR>
[named]$ cat managed-keys.bind <BR>
$ORIGIN .<BR>
$TTL 0 ; 0 seconds<BR>
@ IN SOA . . (<BR>
2 ; serial<BR>
[...]<BR>
<BR>
I have the dnssec flags enabled in the options{} stanza:<BR>
dnssec-enable yes;<BR>
dnssec-validation yes;<BR>
<BR>
<BR>
It appears that sigchase is enabled in named:<BR>
[named]$ /usr/sbin/named -V<BR>
BIND 9.7.3-P1 built with 'x86_64-mandriva-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/lib64' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--x-includes=/usr/include' '--x-libraries=/usr/lib64' '--localstatedir=/var' '--disable-openssl-version-check' '--enable-threads' '--enable-largefile' '--enable-ipv6' '--enable-filter-aaaa' '--enable-epoll' '--with-openssl=/usr' '--with-gssapi=/usr' '--disable-isc-spnego' '--with-randomdev=/dev/urandom' '--with-libxml2=yes' '--with-dlz-postgres=yes' '--with-dlz-mysql=yes' '--with-dlz-bdb=no' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-odbc=no' '--with-dlz-stub=yes' 'build_alias=x86_64-mandriva-linux-gnu' 'host_alias=x86_64-mandriva-linux-gnu' 'target_alias=x86_64-mandriva-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector --param=ssp-buffer-size=4 -fstack-protector-all -DLDAP_DEPRECATED' 'LDFLAGS= -Wl,--as-needed -Wl,--no-undefined -Wl,-z,relro -Wl,-O1 -Wl,--build-id -Wl,--as-needed -Wl,--no-undefined -Wl,-z,relro -Wl,-O1 -Wl,--build-id -Wl,--as-needed -Wl,--no-undefined -Wl,-z,relro -Wl,-O1 -Wl,--build-id -Wl,--as-needed -Wl,--no-undefined -Wl,-z,relro -Wl,-O1 -Wl,--build-id' 'CPPFLAGS= -DDIG_SIGCHASE'<BR>
<BR>
Any advise as to what I might be doing wrong?<BR>
<BR>
-- <BR>
Daniel J McDonald, CCIE # 2495, CISSP # 78281<BR>
<BR>
<BR>
</SPAN></FONT>
</BODY>
</HTML>