DS queries on parents vs. "correct behaviour" in answering

2010-12-04 Thread Peter Janssen
When a validating resolver queries the parent of a zone for the DS record(s), and the (child) zone is NOT signed, the response contains no answer but it does contain NSEC (NSEC3) record(s) in the authority section together with corresponding RRSIG records (parent zone is signed). Would it be consi

Re: DS queries on parents vs. "correct behaviour" in answering

2010-12-04 Thread Mark Andrews
In message <02d001cb93f5$513ca2b0$f3b5e8...@janssen@eurid.eu>, "Peter Janssen" writes: > When a validating resolver queries the parent of a zone for the DS > record(s), > and the (child) zone is NOT signed, the response contains no answer > but it does contain NSEC (NSEC3) record(s) in the autho

Re: DS queries on parents vs. "correct behaviour" in answering

2010-12-04 Thread Mark Andrews
Mark Andrews writes: > > In message <02d001cb93f5$513ca2b0$f3b5e8...@janssen@eurid.eu>, "Peter Janssen > " > writes: > > When a validating resolver queries the parent of a zone for the DS > > record(s), > > and the (child) zone is NOT signed, the response contains no answer > > but it does cont