DS queries on parents vs. "correct behaviour" in answering

When a validating resolver queries the parent of a zone for the DS record(s), and the (child) zone is NOT signed, the response contains no answer but it does contain NSEC (NSEC3) record(s) in the authority section together with corresponding RRSIG records (parent zone is signed). Would it be consi

RE: Dig 9.7 DNSSEC output

en an additional section. Maybe this is related to the EDNS0 stuff? --Pj. Peter Janssen Technical Manager Join us in June! EURid hosts ICANN’s 38th meeting in Brussels.  Find out more at brussels38.icann.org.     EURid     Woluwelaan 150     1831 Diegem - Belgium     TEL.: +32 (0) 2

RE: Dig 9.7 DNSSEC output

Hi Rick, as per the header of Dig output… ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 9 a part from that, I'm glad that my counting is still up to par :-) R. --Pj. Peter Janssen Technical Manager Join us in June! EURid hosts ICANN’s 38th meeting in Brussels.  Fin

Dig 9.7 DNSSEC output

A 212.247.3.83 ;; Query time: 34 msec ;; SERVER: 212.247.7.228#53(212.247.7.228) ;; WHEN: Sun May 9 17:23:51 2010 ;; MSG SIZE rcvd: 153 Am I missing something? Or is this already reported? If so, what would be the correct channel? R. --Pj. Peter Janssen Technical Manager Joi