proper setup of dnssec-validation to _always_ resolve, and retrieve DATA and status flags ?

[dchilton+bind at bestmail.us]

hi,

On Tue, 10 May 2011 15:01 +1000, "Mark Andrews" <marka at isc.org> wrote:
> ok.
> "dig soa com"
> "dig dnskey com"
> "dig ds com"

dig soa com

	; <<>> DiG 9.8.0-P1 <<>> soa com
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 62397
	;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0,
	ADDITIONAL: 0

	;; QUESTION SECTION:
	;com.                           IN      SOA

	;; Query time: 2285 msec
	;; SERVER: 10.10.10.100#53(10.10.10.100)
	;; WHEN: Mon May  9 15:07:04 2011
	;; MSG SIZE  rcvd: 21


dig dnskey com

	; <<>> DiG 9.8.0-P1 <<>> dnskey com
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38413
	;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0,
	ADDITIONAL: 0

	;; QUESTION SECTION:
	;com.                           IN      DNSKEY

	;; ANSWER SECTION:
	com.                    3592    IN      DNSKEY  256 3 8
	AQPCEt+JoihFJuN6AkcVgeK/+DS4ERsI7eqkZQfEvILjrg+YBacnAVMb
	ftPLAdn4A7hOrO1PulW7BtBPgXoK7Sfa+5taEuDtkya7RJOR/ufOeg7h
	guZ3oix2pK0QrI0UvbPpbDKPiBMzxwIxPZrcgZ5KEKKB2KSlmawc9+4p
	7Jq6GQ==
	com.                    3592    IN      DNSKEY  257 3 8
	AQPDzldNmMvZFX4NcNJ0uEnKDg7tmv/F3MyQR0lpBmVcNcsIszxNFxsB
	fKNW9JYCYqpik8366LE7VbIcNRzfp2h9OO8HRl+H+E08zauK8k7evWEm
	u/6od+2boggPoiEfGNyvNPaSI7FOIroDsnw/taggzHRX1Z7SOiOiPWPN
	IwSUyWOZ79VmcQ1GLkC6NlYvG3HwYmynQv6oFwGv/KELSw7ZSdrbTQ0H
	XvZbqMUI7BaMskmvgm1G7oKZ1YiF7O9ioVNc0+7ASbqmZN7Z98EGU/Qh
	2K/BgUe8Hs0XVcdPKrtyYnoQHd2ynKPcMMlTEih2/2HDHjRPJ2aywIpK
	Nnv4oPo/

	;; Query time: 1 msec
	;; SERVER: 10.10.10.100#53(10.10.10.100)
	;; WHEN: Mon May  9 15:07:10 2011
	;; MSG SIZE  rcvd: 441


dig ds com

	; <<>> DiG 9.8.0-P1 <<>> ds com
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63349
	;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0,
	ADDITIONAL: 0

	;; QUESTION SECTION:
	;com.                           IN      DS

	;; ANSWER SECTION:
	com.                    3586    IN      DS      30909 8 2
	E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF
	C41A5766

	;; Query time: 1 msec
	;; SERVER: 10.10.10.100#53(10.10.10.100)
	;; WHEN: Mon May  9 15:07:16 2011
	;; MSG SIZE  rcvd: 69