<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div>Hi Josef,</div>
<div> The default setting for dnssec-validate is "yes" in Bind 9.11.x</div>
<div>The default setting for dnssec-validate is "auto" in Bind 9.16.x</div>
<div><br>
</div>
<div>Note that the setting dnssec-validation yes; is ineffectual unless the server has access to trust anchors from which to establish a DNSSEC-validated chain of trust.</div>
<div><br>
</div>
<div><br>
</div>
<div>read more at: https://kb.isc.org/docs/aa-01547</div>
<div><br>
</div>
Kind Regards Peter
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-workers <bind-workers-bounces@lists.isc.org> on behalf of Josef Moellers <jmoellers@suse.de><br>
<b>Sent:</b> 29 June 2021 14:45<br>
<b>To:</b> bind-workers@lists.isc.org <bind-workers@lists.isc.org><br>
<b>Subject:</b> Behaviour change of dig +dnssec between 9.11 and 9.16</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
A colleague has recently upgraded from 9.11.2 to 9.16.6 and has observed<br>
that with a named that supports DNSSEC<br>
<br>
on 9.11.2:<br>
dig +dnssec @<server><br>
did not return any RRSIG (it did on occasion but not consistently).<br>
<br>
on 9.16.6:<br>
dig +dnssec @<server><br>
now consistently returns the RRSIG every time but<br>
dig +dnssec @<server> org NS<br>
does not return any RRSIG, although the "org" name servers (eg<br>
a0.org.afilias-nst.info) do support it.<br>
<br>
For the last 1½ weeks, I've been trying to dig (pun intended) through<br>
the bind 9.16.18 source code to find how the RRSIG makes its way to the<br>
user's screen but have failed so far.<br>
Can someone either tell my why the behaviour is as described above, ie<br>
why dig without any name and type returns an RRSIG and when being asked<br>
for the NS record of "org" does not send the signature along.<br>
<br>
Thanks, and stay healty!<br>
<br>
Josef<br>
-- <br>
SUSE Software Solutions Germany GmbH<br>
Maxfeldstr. 5<br>
90409 Nürnberg<br>
Germany<br>
<br>
(HRB 36809, AG Nürnberg)<br>
Geschäftsführer: Felix Imendörffer<br>
_______________________________________________<br>
bind-workers mailing list<br>
bind-workers@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-workers">https://lists.isc.org/mailman/listinfo/bind-workers</a><br>
</div>
</span></font></div>
</body>
</html>