<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Bob,<div><br></div><div>as a starter, <a href="http://slashdot.org">slashdot.org</a> is not dnssec-signed, hence it also can't be dnssec-validated / have an <b>a</b>uthoritative <b>d</b>ata flag on the query.</div><div>Try a dig towards <a href="http://www.nlnetlabs.nl">www.nlnetlabs.nl</a>.</div><div><br></div><div>I can't comment on the dnssec-trigger-control-setup output, but I'm pretty certain that dnssec validation is enabled</div><div><br></div><div>Br,</div><div><br></div><div>Thomas Dupas</div><div><br><div><div>On 10 Jun 2012, at 22:04, Bob Katz wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi<div><br></div><div style="text-align:left">I have just installed dnssec–trigger on my mac 10.7.4. The problem is after running the command dnssec–trigger–control–setup I don't know if dnssec is enabled. After I run the dig command I do not get the ad flag and one dnssec test website states no dnssec. However another test website states the dnssec is enabled. I have included in this email a terminal output and a probe result. What am I missing ?</div>
<div style="text-align:left"><br></div><div style="text-align:left">Thanks</div><div style="text-align:left">Bob</div><div style="text-align:left"><br></div><div style="text-align:left"><div>bash-3.2$ sudo dnssec-trigger-control-setup</div>
<div>Password:</div><div>setup in directory /etc/dnssec-trigger</div><div>dnssec_trigger_server.key exists</div><div>dnssec_trigger_control.key exists</div><div>create dnssec_trigger_server.pem (self signed certificate)</div>
<div>create dnssec_trigger_control.pem (signed client certificate)</div><div>Signature ok</div><div>subject=/CN=dnssec-trigger-control</div><div>Getting CA Private Key</div><div>Setup success. Certificates created.</div><div>
<br></div><div>run this script again with -i to:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>- enable remote-control in unbound.conf</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>- start unbound-control-setup</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>- add root trust anchor to unbound.conf</div><div>if you have not done this already</div><div>bash-3.2$ sudo dnssec-trigger-control-setup -i</div><div>setup in directory /etc/dnssec-trigger</div>
<div>unbound-checkconf: no errors in /etc/unbound/unbound.conf</div><div>checking if unbound-control needs to be enabled</div><div>checking if root trust anchor needs to be enabled</div><div>check for search path in resolv.conf and edit /etc/dnssec-trigger/dnssec-trigger.conf</div>
<div>check for domain in resolv.conf and edit /etc/dnssec-trigger/dnssec-trigger.conf</div><div>bash-3.2$ sudo dig <a href="http://www.slashdot.org/">www.slashdot.org</a> @<a href="http://127.0.0.1/">127.0.0.1</a></div><div>
<br></div><div>; <<>> DiG 9.7.3-P3 <<>> <a href="http://www.slashdot.org/">www.slashdot.org</a> @<a href="http://127.0.0.1/">127.0.0.1</a></div><div>;; global options: +cmd</div><div>;; Got answer:</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27876</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 0</div><div><br></div><div>;; QUESTION SECTION:</div><div>;<a href="http://www.slashdot.org/">www.slashdot.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</div>
<div><br></div><div>;; ANSWER SECTION:</div><div><a href="http://www.slashdot.org/">www.slashdot.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>1546<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>216.34.181.48</div>
<div><br></div><div>;; AUTHORITY SECTION:</div><div><a href="http://slashdot.org/">slashdot.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>84346<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns4.p03.dynect.net/">ns4.p03.dynect.net</a>.</div>
<div><a href="http://slashdot.org/">slashdot.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>84346<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns3.p03.dynect.net/">ns3.p03.dynect.net</a>.</div>
<div><a href="http://slashdot.org/">slashdot.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>84346<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns2.p03.dynect.net/">ns2.p03.dynect.net</a>.</div>
<div><a href="http://slashdot.org/">slashdot.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>84346<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns1.p03.dynect.net/">ns1.p03.dynect.net</a>.</div>
<div><br></div><div>;; Query time: 9 msec</div><div>;; SERVER: 127.0.0.1#53(127.0.0.1)</div><div>;; WHEN: Sun Jun 10 15:59:11 2012</div><div>;; MSG SIZE rcvd: 136</div><div><br></div></div>
<span><Screen Shot 2012-06-10 at 3.56.42 PM.png></span>_______________________________________________<br>dnssec-trigger mailing list<br><a href="mailto:dnssec-trigger@NLnetLabs.nl">dnssec-trigger@NLnetLabs.nl</a><br>http://open.nlnetlabs.nl/mailman/listinfo/dnssec-trigger<br></blockquote></div><br></div></body></html>