Can get MX or SOA but not RRSIG

Unbound
1

The domain souissi.net is in the ISC DLV registry.

From Unbound 1.2.0, I can get the MX or the SOA:

% dig +dnssec MX souissi.net
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 9
...

But not the RRSIG:

% dig +dnssec RRSIG souissi.net
...
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 45731
...

BIND 9.5.1 has no problem getting the RRSIG

2

Hi Stephane,

Yes that is a bug. The validator marks the result as bogus because it
cannot find RRSIG(RRSIG). Fixed in trunk r1565.
(it simply omits validation, no AD bit)

Best regards,
   Wouter

Stephane Bortzmeyer wrote:

3

a message of 43 lines which said:

(it simply omits validation, no AD bit)

Yes, that's already what BIND does. Thanks.