1 ; config options 2 ; The island of trust is at example.com 3 server: 4 trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b" 5 trust-anchor: "example.net. 3600 IN DS 1444 8 2 69887be92d4848c0bc10acc95682a01e7e3b57ab0750a2ee6f72cac7191a64f1" 6 val-override-date: "20070916134226" 7 target-fetch-policy: "0 0 0 0 0" 8 qname-minimisation: "no" 9 fake-sha1: yes 10 trust-anchor-signaling: no 11 minimal-responses: no 12 val-log-level: 2 13 ede: yes 14 15 stub-zone: 16 name: "." 17 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 18 CONFIG_END 19 20 SCENARIO_BEGIN Test validator with failure for chain of trust lookup. 21 ; The error message that is created, also for EDE is more extensive. 22 23 ; K.ROOT-SERVERS.NET. 24 RANGE_BEGIN 0 100 25 ADDRESS 193.0.14.129 26 ENTRY_BEGIN 27 MATCH opcode qtype qname 28 ADJUST copy_id 29 REPLY QR NOERROR 30 SECTION QUESTION 31 . IN NS 32 SECTION ANSWER 33 . IN NS K.ROOT-SERVERS.NET. 34 SECTION ADDITIONAL 35 K.ROOT-SERVERS.NET. IN A 193.0.14.129 36 ENTRY_END 37 38 ENTRY_BEGIN 39 MATCH opcode subdomain 40 ADJUST copy_id copy_query 41 REPLY QR NOERROR 42 SECTION QUESTION 43 com. IN NS 44 SECTION AUTHORITY 45 com. IN NS a.gtld-servers.net. 46 SECTION ADDITIONAL 47 a.gtld-servers.net. IN A 192.5.6.30 48 ENTRY_END 49 50 ENTRY_BEGIN 51 MATCH opcode subdomain 52 ADJUST copy_id copy_query 53 REPLY QR NOERROR 54 SECTION QUESTION 55 net. IN NS 56 SECTION AUTHORITY 57 net. IN NS a.gtld-servers.net. 58 SECTION ADDITIONAL 59 a.gtld-servers.net. IN A 192.5.6.30 60 ENTRY_END 61 RANGE_END 62 63 ; a.gtld-servers.net. 64 RANGE_BEGIN 0 100 65 ADDRESS 192.5.6.30 66 ENTRY_BEGIN 67 MATCH opcode qtype qname 68 ADJUST copy_id 69 REPLY QR NOERROR 70 SECTION QUESTION 71 com. IN NS 72 SECTION ANSWER 73 com. IN NS a.gtld-servers.net. 74 SECTION ADDITIONAL 75 a.gtld-servers.net. IN A 192.5.6.30 76 ENTRY_END 77 78 ENTRY_BEGIN 79 MATCH opcode subdomain 80 ADJUST copy_id copy_query 81 REPLY QR NOERROR 82 SECTION QUESTION 83 example.com. IN NS 84 SECTION AUTHORITY 85 example.com. IN NS ns.example.com. 86 SECTION ADDITIONAL 87 ns.example.com. IN A 1.2.3.4 88 ENTRY_END 89 90 ENTRY_BEGIN 91 MATCH opcode subdomain 92 ADJUST copy_id copy_query 93 REPLY QR NOERROR 94 SECTION QUESTION 95 example.net. IN NS 96 SECTION AUTHORITY 97 example.net. IN NS ns.example.net. 98 SECTION ADDITIONAL 99 ns.example.net. IN A 1.2.3.5 100 ENTRY_END 101 RANGE_END 102 103 ; ns.example.com. 104 RANGE_BEGIN 0 100 105 ADDRESS 1.2.3.4 106 ENTRY_BEGIN 107 MATCH opcode qtype qname 108 ADJUST copy_id 109 REPLY QR NOERROR 110 SECTION QUESTION 111 example.com. IN NS 112 SECTION ANSWER 113 example.com. IN NS ns.example.com. 114 example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 115 SECTION ADDITIONAL 116 ns.example.com. IN A 1.2.3.4 117 ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 118 ENTRY_END 119 120 ENTRY_BEGIN 121 MATCH opcode qtype qname 122 ADJUST copy_id 123 REPLY QR AA NOERROR 124 SECTION QUESTION 125 ns.example.com. IN A 126 SECTION ANSWER 127 ns.example.com. IN A 1.2.3.4 128 ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 129 ENTRY_END 130 131 ENTRY_BEGIN 132 MATCH opcode qtype qname 133 ADJUST copy_id 134 REPLY QR AA NOERROR 135 SECTION QUESTION 136 ns.example.com. IN AAAA 137 SECTION AUTHORITY 138 example.com. IN NS ns.example.com. 139 example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 140 SECTION ADDITIONAL 141 ns.example.com. IN A 1.2.3.4 142 ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 143 ENTRY_END 144 145 ; response to DNSKEY priming query 146 ;ENTRY_BEGIN 147 ;MATCH opcode qtype qname 148 ;ADJUST copy_id 149 ;REPLY QR NOERROR 150 ;SECTION QUESTION 151 ;example.com. IN DNSKEY 152 ;SECTION ANSWER 153 ;example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} 154 ;example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854} 155 ;SECTION AUTHORITY 156 ;example.com. IN NS ns.example.com. 157 ;example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 158 ;SECTION ADDITIONAL 159 ;ns.example.com. IN A 1.2.3.4 160 ;ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 161 ;ENTRY_END 162 ; servfail for DNSKEY priming query 163 ENTRY_BEGIN 164 MATCH opcode qtype qname 165 ADJUST copy_id 166 REPLY QR AA SERVFAIL 167 SECTION QUESTION 168 example.com. IN DNSKEY 169 ENTRY_END 170 171 ; response to query of interest 172 ENTRY_BEGIN 173 MATCH opcode qtype qname 174 ADJUST copy_id 175 REPLY QR NOERROR 176 SECTION QUESTION 177 www.example.com. IN A 178 SECTION ANSWER 179 www.example.com. IN A 10.20.30.40 180 ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854} 181 SECTION AUTHORITY 182 example.com. IN NS ns.example.com. 183 example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 184 SECTION ADDITIONAL 185 ns.example.com. IN A 1.2.3.4 186 www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} 187 ENTRY_END 188 RANGE_END 189 190 ; ns.example.com. 191 RANGE_BEGIN 0 100 192 ADDRESS 1.2.3.5 193 ENTRY_BEGIN 194 MATCH opcode qtype qname 195 ADJUST copy_id 196 REPLY QR AA NOERROR 197 SECTION QUESTION 198 example.net. IN NS 199 SECTION ANSWER 200 example.net. 3600 IN NS ns.example.net. 201 example.net. 3600 IN RRSIG NS 8 2 3600 20070926134150 20070829134150 1444 example.net. nHpOqZb00nIGytQ1YmVoXEHURL/75dWhlKSEtRTorjVdPGPZNN7ziCWJW303v7u07TkZ+i6oFVEWG/SDR4ejn5o31UKJy1373PEH/cvPf9/44jw9gAFaHF1eO6ZQGaRQaeEpU06+xUcnc2QXFt6rNu60EsTvMRDN83bD+r7FA7Y= 202 SECTION ADDITIONAL 203 ns.example.net. 3600 IN A 1.2.3.5 204 ns.example.net. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 1444 example.net. TgQ4nfGtLHuZXlC4JJlVQ6mejf1WJbstTxsh/kgMAc2tryOxF/gvGBHaMtz6oceFZrIgk6g3RYI1Gk5gjSFNADh+EIwI422M8XPAAxRLfFahiO4lr1aCo4c94TYeZNpnDKy81rINTz2hQE1pGWr8Z03ySABqSBnTE1FQt4N/JCo= 205 ENTRY_END 206 207 ENTRY_BEGIN 208 MATCH opcode qtype qname 209 ADJUST copy_id 210 REPLY QR AA NOERROR 211 SECTION QUESTION 212 ns.example.net. IN A 213 SECTION ANSWER 214 ns.example.net. 3600 IN A 1.2.3.5 215 ns.example.net. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 1444 example.net. TgQ4nfGtLHuZXlC4JJlVQ6mejf1WJbstTxsh/kgMAc2tryOxF/gvGBHaMtz6oceFZrIgk6g3RYI1Gk5gjSFNADh+EIwI422M8XPAAxRLfFahiO4lr1aCo4c94TYeZNpnDKy81rINTz2hQE1pGWr8Z03ySABqSBnTE1FQt4N/JCo= 216 ENTRY_END 217 218 ENTRY_BEGIN 219 MATCH opcode qtype qname 220 ADJUST copy_id 221 REPLY QR AA NOERROR 222 SECTION QUESTION 223 ns.example.net. IN AAAA 224 SECTION AUTHORITY 225 example.net. 3600 IN SOA ns.example.net. host.example.net. 1 3600 300 7200 3600 226 example.net. 3600 IN RRSIG SOA 8 2 3600 20070926134150 20070829134150 1444 example.net. P5FRQ4A/0n5owaBhZqlYBFD2PNAWJc5oxiDwvwh0hdjxETx8ta3EAvDKtNj5XZ5EKDAhP/tivd+Bq50I0xfRBmrouxgxjgnV3ye8zU+M1fXbuKpsWme9R3S4cs9WYfggTn7X00Af8m0tE62SLH/ZtOOQi2CvOPu7PXtHYT6KW4Q= 227 ENTRY_END 228 229 ENTRY_BEGIN 230 MATCH opcode qtype qname 231 ADJUST copy_id 232 REPLY QR AA NOERROR 233 SECTION QUESTION 234 example.net. IN DNSKEY 235 SECTION ANSWER 236 example.net. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} 237 example.net. 3600 IN RRSIG DNSKEY 8 2 3600 20070926134150 20070829134150 1444 example.net. hAAlJt/YwAgWBzseK0N42+ysSMaWgntcuftF8a43chLh+fbe3vPWrgwqr/Cic52tu4ZqMox592tqWDxAG7F1eDGfO0SfzS2C9Tc/Wnz5nFjFh75G4Mtt8DTv5vTyGUVX5zAFzV8SNijVC0o1F7MHaVPt3rFtjjg2zW/UOz2m9+U= 238 ENTRY_END 239 240 ; For sub1.example.net. zone; it is co-hosted with example.net, so that 241 ; there can be failures for the DS lookup. But the data lookup succeeds. 242 ENTRY_BEGIN 243 MATCH opcode qtype qname 244 ADJUST copy_id 245 REPLY QR AA NOERROR 246 SECTION QUESTION 247 www.sub1.example.net. IN A 248 SECTION ANSWER 249 www.sub1.example.net. IN A 10.20.30.41 250 www.sub1.example.net. 3600 IN RRSIG A 8 4 3600 20070926134150 20070829134150 29332 sub1.example.net. NcFP77Hixawt8hb+STIbbeqdF9tWTuHsbGEB4agKXlwHqS0BnyA+It6+UdE57IF0Kbnc7gSuaslX9At8ctd4HuC/9F/osbo96o23JEfnXPky/r5SsLaeN5KmUmUVjG9oxyAEc6PVlaaQ5a/RhaxmDRaDiku2gB7KjdjPxwxe+Rc54GV2eM3GtcfT+oDakLdSSACqeVjUFIOtYMpG8jAHrBe4uSnjKI7O0fWDFN5OES6sN9iUS9/ceorIoF/gSIqM7xWEuPLxE2c5TtYJyPtMCeGJ9wBP4wrTXfJ58+Lg5SFKgEuKTvAqEv9KEwg/kJb1GQ+ho5XKFO6EII2iyeUK/w== 251 ENTRY_END 252 253 ENTRY_BEGIN 254 MATCH opcode qtype qname 255 ADJUST copy_id 256 REPLY QR SERVFAIL 257 SECTION QUESTION 258 sub1.example.net. IN DS 259 SECTION ANSWER 260 ; no DS for sub1.example.net id=29332 algo=8 261 ENTRY_END 262 263 ENTRY_BEGIN 264 MATCH opcode qtype qname 265 ADJUST copy_id 266 REPLY QR AA NOERROR 267 SECTION QUESTION 268 www.sub2.example.net. IN A 269 SECTION ANSWER 270 www.sub2.example.net. IN A 10.20.30.42 271 www.sub2.example.net. 3600 IN RRSIG A 8 4 3600 20070926134150 20070829134150 29332 sub2.example.net. FOY6YxNoFyrSkBtWV7HcECmORTMedRWHdGk7Rm04icT8Bw0dWfzVaIpAkBY6FXx8UvqN7McN4IJI5dAVXptfekO+Yvy2PwkjehRUXvQK64XH5UM5pVbX5g8E4pnOrLa/jzPB7srzMpyWVCpt81lPoFpdfXUMm7434ifkTYhpAll7y5NAocFiT3F+XGe06qMIr51WxoFfegIGohMFhkTDUdLWrdV10128W+NzPdwoYtiigtCObKxTtyj3gK+mxqXvX4X4F2YIGQ+mx62ovdUilnLYZm/WC/ZQkdxeOZjeCTxvSpGGG+wtu1QufgIJ+BpAZAOxREOYZkhR29AG0np4EA== 272 ENTRY_END 273 274 ENTRY_BEGIN 275 MATCH opcode qtype qname 276 ADJUST copy_id 277 REPLY QR SERVFAIL 278 SECTION QUESTION 279 sub2.example.net. IN DNSKEY 280 SECTION ANSWER 281 ; sub2.example.net. IN DNSKEY 257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b} 282 ENTRY_END 283 284 ENTRY_BEGIN 285 MATCH opcode qtype qname 286 ADJUST copy_id 287 REPLY QR AA NOERROR 288 SECTION QUESTION 289 sub2.example.net. IN DS 290 SECTION ANSWER 291 sub2.example.net. 3600 IN DS 29332 8 2 d53e615d9d736b0f2a0097f1d5fa51c84320610f94ecbd7197e7de5f44f02d72 292 sub2.example.net. 3600 IN RRSIG DS 8 3 3600 20070926134150 20070829134150 1444 example.net. dYLYs1uMxJm5+MB6L1+uStE5S1YtyYR0JF+1pPoTptc/H1hYqMxK7pVQPtIGvq8j8wNyC7jOzALfEXgwRKiSdR1l1GQ5HIxWkhUmkpLcecwJOjemee4nXaifOFa5bdbdYpuDwTiIzx+PvanlaVjEPy0i1IukanDi6jojfyWcgLA= 293 ENTRY_END 294 RANGE_END 295 296 STEP 1 QUERY 297 ENTRY_BEGIN 298 REPLY RD DO 299 SECTION QUESTION 300 www.example.com. IN A 301 ENTRY_END 302 303 ; The DNSKEY lookup for the key prime is a failure. 304 STEP 10 CHECK_ANSWER 305 ENTRY_BEGIN 306 MATCH all ede=9 307 REPLY QR RD RA DO SERVFAIL 308 SECTION QUESTION 309 www.example.com. IN A 310 SECTION ANSWER 311 ENTRY_END 312 313 STEP 20 QUERY 314 ENTRY_BEGIN 315 REPLY RD DO 316 SECTION QUESTION 317 www.sub1.example.net. IN A 318 ENTRY_END 319 320 ; The DS lookup is a failure. 321 STEP 30 CHECK_ANSWER 322 ENTRY_BEGIN 323 MATCH all ede=23 324 REPLY QR RD RA DO SERVFAIL 325 SECTION QUESTION 326 www.sub1.example.net. IN A 327 SECTION ANSWER 328 ENTRY_END 329 330 STEP 40 QUERY 331 ENTRY_BEGIN 332 REPLY RD DO 333 SECTION QUESTION 334 www.sub2.example.net. IN A 335 ENTRY_END 336 337 ; The DNSKEY lookup is a failure. 338 STEP 50 CHECK_ANSWER 339 ENTRY_BEGIN 340 MATCH all ede=9 341 REPLY QR RD RA DO SERVFAIL 342 SECTION QUESTION 343 www.sub2.example.net. IN A 344 SECTION ANSWER 345 ENTRY_END 346 347 SCENARIO_END 348
Indexes created Mon Jun 01 00:24:59 UTC 2026