<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">On 15 December 2017 at 6:09:19 pm, W.C.A. Wijngaards via Unbound-users (<a href="mailto:unbound-users@unbound.net">unbound-users@unbound.net</a>) wrote:</div> <div><blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><span><div><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">When I run unbound-host, I get no errors,<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">./unbound-host<span class="Apple-converted-space"> </span><span class="Apple-converted-space"> </span></span><a href="http://www.wilda.nsec.0skar.czwww.wilda.nsec.0skar.cz" style="font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">www.wilda.nsec.0skar.czwww.wilda.nsec.0skar.cz</a><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;"><span class="Apple-converted-space"> </span>-f<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">root.key -v -t A<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><a href="http://www.wilda.nsec.0skar.czwww.wilda.nsec.0skar.cz" style="font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">www.wilda.nsec.0skar.czwww.wilda.nsec.0skar.cz</a><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;"><span class="Apple-converted-space"> </span>has address<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">85.239.227.179 (secure)<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">Unbound performs serial arithmatic on the timestamps in the rrsig,<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">according to RFC.<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">(What does that mean? The timestamps are 32bit in the RRSIG, but the<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">value is interpreted relative to the current date. And what you cannot<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">do is express something like a point more than some number of years<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">future or past.)<span class="Apple-converted-space"> </span></span><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: "helvetica Neue", helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">Best regards, Wouter<span class="Apple-converted-space"> </span></span></div></span></blockquote></div><p><br></p><p><font face="Helvetica"><span style="font-size: 14px;">Hello Wouter,</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"><br></span></font></p><p><font face="Helvetica"><span style="font-size: 14px;">Thanks for the insight. Maybe this has something to with the platform?</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> CentOS 6.9:</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> $ unbound-host -v -f /etc/unbound/root.key -t A www.wilda.nsec.0skar.cz</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> www.wilda.nsec.0skar.cz is an alias for flexi.oskarcz.net. (secure)</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> flexi.oskarcz.net has address 85.239.227.179 (secure)</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"><br></span></font></p><p><font face="Helvetica"><span style="font-size: 14px;">MacOS 10.13.2 (High Sierra):</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> $ unbound-host -v -t A -f /usr/local/etc/unbound/root.key www.wilda.nsec.0skar.cz</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> www.wilda.nsec.0skar.cz is an alias for flexi.oskarcz.net. (BOGUS (security failure))</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> flexi.oskarcz.net has address 85.239.227.179 (BOGUS (security failure))</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> validation failure <www.wilda.nsec.0skar.cz. A IN>: signature inception after expiration from 85.239.227.179 for key nsec.0skar.cz. while building chain of trust</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"><br></span></font></p><p><font face="Helvetica"><span style="font-size: 14px;">FreeBSD 11.1:</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> $ unbound-host -v -f /usr/local/etc/unbound/root.key -t A www.wilda.nsec.0skar.cz</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> www.wilda.nsec.0skar.cz is an alias for flexi.oskarcz.net. (BOGUS (security failure))</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> flexi.oskarcz.net has address 85.239.227.179 (BOGUS (security failure))</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;"> validation failure <www.wilda.nsec.0skar.cz. A IN>: signature inception after expiration from 2001:1528:132:70::1 for key nsec.0skar.cz. while building chain of trust</span></font></p><div><font face="Helvetica"><span style="font-size: 14px;"><br></span></font></div><p><font face="Helvetica"><span style="font-size: 14px;">Kind Regards</span></font></p><p><font face="Helvetica"><span style="font-size: 14px;">Sebastian</span></font></p><div></div></body></html>