proper setup of dnssec-validation to _always_ resolve, and retrieve DATA and status flags ?

[dchilton+bind at bestmail.us]

hi,

On Tue, 10 May 2011 14:48 +1000, "Mark Andrews" <marka at isc.org> wrote:
> What does "dig DS adobe.com" return?

dig DS adobe.com

	; <<>> DiG 9.8.0-P1 <<>> DS adobe.com
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 37646
	;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0,
	ADDITIONAL: 0

	;; QUESTION SECTION:
	;adobe.com.                     IN      DS

	;; Query time: 2415 msec
	;; SERVER: 10.10.10.100#53(10.10.10.100)
	;; WHEN: Mon May  9 14:52:04 2011
	;; MSG SIZE  rcvd: 27

and just for comparison,

dig DS pir.org

	; <<>> DiG 9.8.0-P1 <<>> DS pir.org
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16298
	;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0,
	ADDITIONAL: 0

	;; QUESTION SECTION:
	;pir.org.                       IN      DS

	;; ANSWER SECTION:
	pir.org.                3581    IN      DS      54135 5 2
	6CDE2DE97F1D07B23134440F19682E7519ADDAE180E20B1B1EC52E7F
	58B2831D
	pir.org.                3581    IN      DS      54135 5 1
	225F055ACB65C8B60AD18B3640062E8C23A5FD89

	;; Query time: 1 msec
	;; SERVER: 10.10.10.100#53(10.10.10.100)
	;; WHEN: Mon May  9 14:52:06 2011
	;; MSG SIZE  rcvd: 109

DCh