[Unbound-users] Signed .de zone - temporary validation errors
paul at xelerance.com
Wed Mar 31 15:44:56 UTC 2010
On Wed, 31 Mar 2010, Roy Arends wrote:
>> name: "de"
>> stub-addr: 220.127.116.11 # auth-fra.dnssec.denic.de
>> stub-addr: 2A02:568:0:1::53
>> stub-addr: 18.104.22.168 # auth-ams.dnssec.denic.de
>> stub-prime: no
> That server (22.214.171.124/126.96.36.199) will tell you that the actual nameservers for .de are [cls].de.net. and [afz].nic.de. Subsequently, the resolver asks one of these servers for an answer, and gets an unsigned delegation. Hence the validation failure.
> This is how it worked in the java version of unbound.
Isn't that why stub-prime: no is there (and the reason why this is so hard to do with
bind because it does not have the equivalent feature) ?
stub-prime: <yes or no>
This option is by default off. If enabled it performs NS set
priming, which is similar to root hints, where it starts using
the list of nameservers currently published by the zone. Thus,
if the hint list is slightly outdated, the resolver picks up a
correct list online.
More information about the Unbound-users