Query forwarding & DNSSEC

[Havard Eidnes]

Hi,

following up to my own question with a little more information:

> However, for whatever reason, lookups in what can be called the
> "local domain" fails with SERVFAIL.  Cranking up the logging of
> unbound, I find in the log
>
> info: Could not establish a chain of trust to keys for example.no. DNSKEY IN
>
> (actual name withheld).  I've run "dig" towards both of the
> forward-addr listed name servers, and they both return a "nodata"
> response when queried for the DNSKEY or the DS record for the
> "example.no" domain (as they should).  So why does unbound think
> it has a DNSKEY to validate against?!?

Actually, when I do

dig @<local-upstream-resolver> example.no. ds

what I get back is a "nodata" response, but the authority section
contains the example.no SOA record (and the AA flag is set), and
not the .NO SOA, as it should if the upstream name servers knew
the special rule for placement of authority for the DS record
(which rests with the parents), which the upstream name servers
apparently don't.  And of course, since the upstreams don't do
DNSSEC validation, no DNSSEC proof of the non-existence of the DS
record is provided.  The .NO domain is signed, so unbound is
probably unable to verify that there is no DS record for the
example.no zone...  ...in which case the error message logged
could be a little bit clearer...

Regards,

- Håvard