trouble with .gov dns?

Mon May 2 23:47:15 UTC 2011

Florian Weimer <fw at deneb.enyo.de> wrote:
>
> > I have "dnssec-enable no;" in my bind config.
>
> It does not seem to have the intended effect.

BIND's interpretation of the DO bit is "I understand DNSSEC RRs so it is
OK to send them" not "I would like you to send DNSSEC RRs". This is why it
always sets the DO bit when it can, i.e. when the request contains an EDNS
OPT pseudo-RR.

Tony.
-- 
f.anthony.n.finch  <dot at dotat.at>  http://dotat.at/
Rockall, Malin, Hebrides: South 5 to 7, occasionally gale 8 at first in
Rockall and Malin, veering west or northwest 4 or 5, then backing southwest 5
or 6 later. Rough or very rough. Occasional rain. Moderate or good,
occasionally poor.