dE . <de.tec...@gmail.com> wrote:
>
> Ok, so the DS record is not encrypted.
DNSSEC is about signatures: nothing is encrypted. DS records are signed:
a DS RRset has an RRSIG. For example,
; <<>> DiG 9.8.1-P1 <<>> +multi +dnssec DS isc.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53813
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;isc.org. IN DS
;; ANSWER SECTION:
isc.org. 86382 IN DS 12892 5 1 (
982113D08B4C6A1D9F6AEE1E2237AEF69F3F9759 )
isc.org. 86382 IN DS 12892 5 2 (
F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F
0EB5C777586DE18DA6B5 )
isc.org. 86382 IN RRSIG DS 7 2 86400 20120309160141 (
20120217150141 55440 org.
SHpqmMeBQAyBB5LgBcrR5FcZiWiEudop/fl7X1xgz31X
G4vFFQzq57RIq0hUkWZ0dR5oBCpRC15osOXSZEwVuz3L
XXUd63GpI5aoGv/OtyPI/w4YTedgweoE9PWovcx6Ahr2
WonckP2YqTsHqzxwr+VSiiMFMe2VVquTo4/vEjE= )
;; Query time: 9 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Feb 20 12:33:26 2012
;; MSG SIZE rcvd: 283
Tony.
--
f.anthony.n.finch <d...@dotat.at> http://dotat.at/
Dover, Wight, Portland, Plymouth: Southwesterly 4 or 5, increasing 6 or 7
later. Slight becoming moderate. Mainly fair. Mainly good.
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
