Re: puzzling answer of dig with +sigchase/NSEC3

2009-11-09 Thread Evan Hunt
On Mon, Nov 09, 2009 at 04:47:02PM +0100, Klaus Malorny wrote: > I would have expected to get a "SUCCESS" also, i.e. that the negative > answer could have been validated so far. Did I miss anything? For zones > using NSEC, like "se", this seems to work. Is there no full support for > NSEC3 in d

puzzling answer of dig with +sigchase/NSEC3

2009-11-09 Thread Klaus Malorny
Hi, I am playing around with a signed zone which uses NSEC3. If I try to verify a non-existing name or a non-existing type with the "sigchase" option, I get the strange error: ;; Impossible to verify the Non-existence, the NSEC RRset can't be validated: FAILED I then checked it with the "o