1 ; config options 2 ; The island of trust is at test. 3 server: 4 trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b" 5 val-override-date: "20201020135527" 6 target-fetch-policy: "0 0 0 0 0" 7 qname-minimisation: "no" 8 fake-sha1: yes 9 trust-anchor-signaling: no 10 minimal-responses: no 11 iter-scrub-promiscuous: no 12 aggressive-nsec: no 13 local-zone: test. nodefault 14 log-servfail: yes 15 16 stub-zone: 17 name: "." 18 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 19 CONFIG_END 20 21 SCENARIO_BEGIN Test NS wildcard with NSEC that has DS denial. 22 ; The NS wildcard NSEC should not be used to deny the DS. 23 24 ; K.ROOT-SERVERS.NET. 25 RANGE_BEGIN 0 100 26 ADDRESS 193.0.14.129 27 ENTRY_BEGIN 28 MATCH opcode qtype qname 29 ADJUST copy_id 30 REPLY QR NOERROR 31 SECTION QUESTION 32 . IN NS 33 SECTION ANSWER 34 . IN NS K.ROOT-SERVERS.NET. 35 SECTION ADDITIONAL 36 K.ROOT-SERVERS.NET. IN A 193.0.14.129 37 ENTRY_END 38 39 ENTRY_BEGIN 40 MATCH opcode subdomain 41 ADJUST copy_id copy_query 42 REPLY QR NOERROR 43 SECTION QUESTION 44 test. IN NS 45 SECTION AUTHORITY 46 test. IN NS ns.test. 47 SECTION ADDITIONAL 48 ns.test. IN A 1.2.3.5 49 ENTRY_END 50 51 ENTRY_BEGIN 52 MATCH opcode qtype qname 53 ADJUST copy_id 54 REPLY QR AA NOERROR 55 SECTION QUESTION 56 ns.other. IN A 57 SECTION ANSWER 58 ns.other. IN A 1.2.3.6 59 ENTRY_END 60 61 ENTRY_BEGIN 62 MATCH opcode qtype qname 63 ADJUST copy_id 64 REPLY QR AA NOERROR 65 SECTION QUESTION 66 ns.other. IN AAAA 67 SECTION AUTHORITY 68 . IN SOA ns.example.com. host.example.com. 1 86400 7200 86400 3600 69 ENTRY_END 70 RANGE_END 71 72 ; ns.test 73 RANGE_BEGIN 0 100 74 ADDRESS 1.2.3.5 75 ENTRY_BEGIN 76 MATCH opcode qtype qname 77 ADJUST copy_id 78 REPLY QR AA NOERROR 79 SECTION QUESTION 80 test. IN NS 81 SECTION ANSWER 82 test. IN NS ns.test 83 test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s= 84 SECTION ADDITIONAL 85 ns.test. IN A 1.2.3.5 86 ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= 87 ENTRY_END 88 89 ENTRY_BEGIN 90 MATCH opcode qtype qname 91 ADJUST copy_id 92 REPLY QR AA NOERROR 93 SECTION QUESTION 94 ns.test. IN A 95 SECTION ANSWER 96 ns.test. IN A 1.2.3.5 97 ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= 98 ENTRY_END 99 100 ENTRY_BEGIN 101 MATCH opcode qtype qname 102 ADJUST copy_id 103 REPLY QR AA NOERROR 104 SECTION QUESTION 105 ns.test. IN AAAA 106 SECTION AUTHORITY 107 test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 108 test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= 109 ns.test. 3600 IN NSEC nz.test. A RRSIG 110 ns.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU= 111 ENTRY_END 112 113 ENTRY_BEGIN 114 MATCH opcode qtype qname 115 ADJUST copy_id 116 REPLY QR AA NOERROR 117 SECTION QUESTION 118 test. IN DNSKEY 119 SECTION ANSWER 120 test. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} 121 test. 3600 IN RRSIG DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc= 122 SECTION ADDITIONAL 123 ENTRY_END 124 125 ; The actual example.test delegation. 126 ;ENTRY_BEGIN 127 ;MATCH opcode qname qtype 128 ;ADJUST copy_id 129 ;REPLY QR AA NOERROR 130 ;SECTION QUESTION 131 ;example.test. IN DS 132 ;SECTION ANSWER 133 ;example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 134 ;;example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= 135 ;ENTRY_END 136 ; 137 ;ENTRY_BEGIN 138 ;MATCH opcode subdomain 139 ;ADJUST copy_id copy_query 140 ;REPLY QR NOERROR 141 ;SECTION QUESTION 142 ;example.test. IN NS 143 ;SECTION AUTHORITY 144 ;example.test. IN NS ns.example.test. 145 ;example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 146 ;example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= 147 ;SECTION ADDITIONAL 148 ;ns.example.test. IN A 1.2.3.4 149 ;ENTRY_END 150 ; 151 ; The following wildcard exists in the parent zone, 152 ; *.test. IN NS ns.service.test. 153 ; this creates an NSEC record 154 ; *.test. IN NSEC aa.test. NS RRSIG NSEC 155 ; this is used in the replay reply for the delegation, 156 ; changing the owner name to example.test. 157 ; 158 ; *.test. 3600 IN NS ns.service.test. 159 ; *.test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. G+b6EsP49+D/r8JZznWUNbf5QVTP/JcH/0mifzdCPB4c19sNQ8R52/RESMREilB3u2mnZUBpiZRozIOOjv8ZNgVvPmALslYPX1qPVT1qmYzLDl0NTN+ebLpf69V/XXLHi9aG5SgtOcTJHN3M4R3HMt1s9po1oTKMMwv1Ss+EtcE= 160 ; 161 ; *.test. 3600 IN NSEC aa.test. NS RRSIG NSEC 162 ; *.test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. nIB5+xRH8rMdECAL5TDfujWe/BiWHyN3Y2P1iBG3Z+6JcA/FwBEMxNzcjA08FQc3Eu9uh/7sB+9NJN7bOEZoMzL2mETGaR5uM7HfUx6JpfK4RpoG66MnzbXbWjDOH+sF8Ei4ziR3p2AoWKg8wBzh6wP2YlLun0v4f6+fU8A5Yh8= 163 ; 164 ; and also for the DS lookup 165 ENTRY_BEGIN 166 MATCH opcode qtype qname 167 ADJUST copy_id 168 REPLY QR NOERROR 169 SECTION QUESTION 170 example.test. IN DS 171 SECTION AUTHORITY 172 ; note the labelcount of 1 in the RRSIG, it is a wildcard. 173 example.test. 3600 IN NSEC aa.test. NS RRSIG NSEC 174 example.test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. nIB5+xRH8rMdECAL5TDfujWe/BiWHyN3Y2P1iBG3Z+6JcA/FwBEMxNzcjA08FQc3Eu9uh/7sB+9NJN7bOEZoMzL2mETGaR5uM7HfUx6JpfK4RpoG66MnzbXbWjDOH+sF8Ei4ziR3p2AoWKg8wBzh6wP2YlLun0v4f6+fU8A5Yh8= 175 ; there is no next closer denial NSEC. The example.test delegation exists, 176 ; so the parent has not signed that. 177 ENTRY_END 178 179 ENTRY_BEGIN 180 MATCH opcode subdomain 181 ADJUST copy_id copy_query 182 REPLY QR NOERROR 183 SECTION QUESTION 184 example.test. IN NS 185 SECTION AUTHORITY 186 ; note the labelcount of 1 in the RRSIG, it is a wildcard. 187 example.test. 3600 IN NSEC aa.test. NS RRSIG NSEC 188 example.test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. nIB5+xRH8rMdECAL5TDfujWe/BiWHyN3Y2P1iBG3Z+6JcA/FwBEMxNzcjA08FQc3Eu9uh/7sB+9NJN7bOEZoMzL2mETGaR5uM7HfUx6JpfK4RpoG66MnzbXbWjDOH+sF8Ei4ziR3p2AoWKg8wBzh6wP2YlLun0v4f6+fU8A5Yh8= 189 ; there is no next closer denial NSEC. The example.test delegation exists, 190 ; so the parent has not signed that. 191 example.test. IN NS ns.other. 192 SECTION ADDITIONAL 193 ns.other. IN A 1.2.3.6 194 ENTRY_END 195 RANGE_END 196 197 ; ns.example.test. 198 RANGE_BEGIN 0 100 199 ADDRESS 1.2.3.4 200 ENTRY_BEGIN 201 MATCH opcode qtype qname 202 ADJUST copy_id 203 REPLY QR NOERROR 204 SECTION QUESTION 205 example.test. IN NS 206 SECTION ANSWER 207 example.test. IN NS ns.example.test. 208 example.test. 3600 IN RRSIG NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4= 209 SECTION ADDITIONAL 210 ns.example.test. IN A 1.2.3.4 211 ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= 212 ENTRY_END 213 214 ENTRY_BEGIN 215 MATCH opcode qtype qname 216 ADJUST copy_id 217 REPLY QR AA NOERROR 218 SECTION QUESTION 219 ns.example.test. IN A 220 SECTION ANSWER 221 ns.example.test. IN A 1.2.3.4 222 ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= 223 ENTRY_END 224 225 ENTRY_BEGIN 226 MATCH opcode qtype qname 227 ADJUST copy_id 228 REPLY QR AA NOERROR 229 SECTION QUESTION 230 ns.example.test. IN AAAA 231 SECTION AUTHORITY 232 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 233 example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= 234 ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG 235 ENTRY_END 236 237 ; response to DNSKEY priming query 238 ENTRY_BEGIN 239 MATCH opcode qtype qname 240 ADJUST copy_id 241 REPLY QR NOERROR 242 SECTION QUESTION 243 example.test. IN DNSKEY 244 SECTION ANSWER 245 example.test. 3600 IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} 246 example.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g= 247 ENTRY_END 248 249 ; response to query of interest 250 ENTRY_BEGIN 251 MATCH opcode qtype qname 252 ADJUST copy_id 253 REPLY QR AA NOERROR 254 SECTION QUESTION 255 www.example.test. IN A 256 SECTION ANSWER 257 www.example.test. IN A 10.20.30.40 258 ENTRY_END 259 RANGE_END 260 261 RANGE_BEGIN 0 100 262 ADDRESS 1.2.3.6 263 ENTRY_BEGIN 264 MATCH opcode qtype qname 265 ADJUST copy_id 266 REPLY QR AA NOERROR 267 SECTION QUESTION 268 www.example.test. IN A 269 SECTION ANSWER 270 www.example.test. IN A 10.20.30.66 271 ENTRY_END 272 RANGE_END 273 274 STEP 1 QUERY 275 ENTRY_BEGIN 276 REPLY RD DO 277 SECTION QUESTION 278 www.example.test. IN A 279 ENTRY_END 280 281 STEP 10 CHECK_ANSWER 282 ENTRY_BEGIN 283 MATCH all 284 REPLY QR RD RA DO SERVFAIL 285 SECTION QUESTION 286 www.example.test. IN A 287 SECTION ANSWER 288 ENTRY_END 289 290 ; to resolve pending lookups 291 STEP 20 TRAFFIC 292 SCENARIO_END 293
Indexes created Mon Oct 26 00:26:21 UTC 2026