On 4/18/12 10:46 AM, Carlos Ribas wrote: > Is your recursive resolver also authoritative for raindrop.us? > If so, you will not get the "ad" flag. You can > test with DNS-OARC resolver [1]: > > # dig +dnssec +multiline @149.20.64.20 raindrop.us Why would 149.20.64.20 return ad then? It's not authoritative either...